r4.2 Inventory and validate certificates and connection trust
Maintain an inventory of trusted certificates and ensure that the keys and certificates used to protect PAN in transit are valid, current, and trusted.
AWS services
AWS Certificate Manager 
AWS Private CA 
Amazon EventBridge 
AWS Config Requirement 4
Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks
PCI sub-requirements covered
- 4.2 PAN is protected with strong cryptography during transmission
How to implement on AWS
Centralize issuance with ACM and ACM Private CA for internal connections. Monitor certificate expiration with EventBridge/Config. Maintain an inventory of certificates and their uses. Enforce certificate validation on clients that transmit PAN.
Practical implementation
How this control is implemented in each reference architecture:
Issue public certificates with ACM and internal ones with ACM Private CA; keep an inventory and monitor expiry with EventBridge/Config in the account.
Single-account, 3-tier →Run ACM Private CA centrally (network or security account) and share it to CDE accounts, giving one trusted internal CA hierarchy and a consolidated certificate inventory across the organization.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine policies and procedures to verify a process is defined to maintain an inventory of trusted keys and certificates (4.2.1.1.a).
- Examine the inventory of trusted keys and certificates to verify it is kept up to date (4.2.1.1.b).
Evidence in AWS
- ACM/Private CA certificate inventory with validity dates.
- Expiration alerts configured (EventBridge/Config).
- Certificate-validation configuration on services that transmit PAN.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 4.2 — Cleartext PAN cannot be read or intercepted from any transmissions over open, public networks.
Learning resources
References
- PCI DSS v4.0.1 Requirement 4.2.1.1