Amazon web services 如何在AWS ACMPCA中使用非自签名证书

我正在尝试在AWS ACMPCA中使用非自签名证书。问题在于，通过遵循AWS ACMPCA，会创建自签名证书。然后，当我继续时，创建一个下级CA，颁发证书，并在内部ALB上使用它，当我使用

curl

进行测试时，我会得到一个自签名证书错误。显然，证书未经独立验证，因此这是有意义的。但唯一的解决方法是传递

——不安全的
，但这将导致应用程序的代码更改

所以我似乎需要将签名证书导入ACMPCA，或者我需要发出签名证书请求？我不太确定。我不太熟悉这种架构，这是我第一次

我的问题是：我需要做什么才能在AWS ACMPCA中颁发私有的、非自签名的ssl证书，以便我的内部应用程序可以使用https而不禁用验证

我使用以下模板在Cloudformation中创建了所有这些：

    RootCertificateAuthority:
        Type: AWS::ACMPCA::CertificateAuthority
        Properties:
            KeyAlgorithm: RSA_4096
            SigningAlgorithm: SHA512WITHRSA
            Subject:
                Organization: MyOrg
            Type: ROOT

    RootCertificate:
        Type: AWS::ACMPCA::Certificate
        Properties:
            CertificateAuthorityArn: !Ref RootCertificateAuthority
            CertificateSigningRequest: !GetAtt RootCertificateAuthority.CertificateSigningRequest
            TemplateArn: arn:aws:acm-pca:::template/RootCACertificate/V1
            SigningAlgorithm: SHA512WITHRSA
            Validity:
                Type: YEARS
                Value: 100

    RootCertificateActivation:
        Type: AWS::ACMPCA::CertificateAuthorityActivation
        Properties:
            CertificateAuthorityArn: !Ref RootCertificateAuthority
            Certificate: !GetAtt RootCertificate.Certificate
            Status: ACTIVE

    SubordinateCertificateAuthority:
        Type: AWS::ACMPCA::CertificateAuthority
        Properties:
            KeyAlgorithm: RSA_4096
            SigningAlgorithm: SHA512WITHRSA
            Subject:
                Organization: MyOrg
            Type: SUBORDINATE

    SubordinateCertificate:
        Type: AWS::ACMPCA::Certificate
        Properties:
            CertificateAuthorityArn: !Ref RootCertificateAuthority
            CertificateSigningRequest: !GetAtt SubordinateCertificateAuthority.CertificateSigningRequest
            TemplateArn: 'arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen3/V1'
            SigningAlgorithm: SHA512WITHRSA
            Validity:
                Type: YEARS
                Value: 99

    SubordinateCertificateActivation:
        Type: AWS::ACMPCA::CertificateAuthorityActivation
        Properties:
            CertificateAuthorityArn: !Ref SubordinateCertificateAuthority
            Certificate: !GetAtt SubordinateCertificate.Certificate
            CertificateChain: !GetAtt RootCertificateActivation.CompleteCertificateChain
            Status: ACTIVE