Automating SSL/TLS Certificate Management with AWS Certificate Manager - From Issuance to Rotation

This article explains free issuance of public certificates with ACM, DNS validation, automatic renewal, and deployment to ALB / CloudFront.

About 7 min readLast updated: 2026-10-31

Overview of ACM

ACM is a service that automates the issuance, management, and deployment of SSL/TLS certificates. Public certificates can be issued at no charge and can be used with ALB, NLB, CloudFront, API Gateway, and Elastic Beanstalk. ACM manages the renewal of certificates that ACM has issued, so you do not need to manage renewal with cron jobs or certbot. Placing a certificate directly on an EC2 instance is handled differently from assigning a certificate to an integrated service, so if you terminate HTTPS on EC2, consider a configuration with an ALB in front or using Let's Encrypt.

DNS Validation and Automatic Renewal

The certificate validation methods are DNS validation and email validation, and for certificates for CloudFront, HTTP validation can be used only for some CloudFront features. With DNS validation, you add the CNAME record specified by ACM to Route 53 (or an external DNS). If you use Route 53, you can add the record from the console. Email validation is a method that sends a confirmation email to the domain's administrator email address, and because it requires manual approval at every renewal, AWS recommends DNS validation, which supports automatic renewal. Once added, a DNS validation record remains valid unless you delete it, and it continues to be used for the automatic renewal of the certificate. ACM's automatic renewal starts before the certificate expires, and the certificate is renewed automatically as long as the DNS validation record exists and the certificate is associated with an AWS resource. The validity period of ACM certificates is 198 days, and renewed certificates are automatically reflected in ALB and CloudFront.

Private Certificates and Certificate Transparency

By integrating with ACM Private CA, you can issue private certificates for service-to-service communication within your organization. Because public certificates are recorded in Certificate Transparency (CT) logs, you use private certificates when you do not want to expose the host names of internal services. You can also manage certificates issued by an external CA with the ACM import feature, but automatic renewal is supported only for certificates issued by ACM. When a certificate's expiration date approaches, you are notified through CloudWatch metrics and EventBridge events, so you can notice missed renewals. Because certificates must be issued per Region, in a multi-Region configuration you manage certificates in each Region.

ACM Pricing

ACM public certificates can be issued / renewed at no charge. Deploying to ALB, CloudFront, and API Gateway also incurs no additional charge. ACM Private CA costs about $400/CA per month, and an additional charge applies based on the number of certificates issued (for the first 1,000 certificates, $0.75 per certificate) (as of August 2026). In short-lived certificate mode (validity period of 7 days or less), the monthly CA charge is discounted to about $50. You manage costs by using ACM's free certificates for use cases that public certificates can handle, and limiting Private CA to cases where it is needed, such as mTLS and internal service authentication.

Configuration Patterns by Deployment Target

Note that the Region in which you place an ACM certificate changes depending on the AWS resource that uses it. Certificates applied to CloudFront must be issued in the N. Virginia Region because of how global delivery works. On the other hand, for regional resources such as ALB and API Gateway, you use a certificate in the same Region as the resource. If you issue a certificate without knowing this difference, the certificate may not appear among the choices for the deployment target. At the stage of drawing the architecture diagram, you sort out which Region's certificate to assign to which resource.

Operations That Prevent Renewal Failures

ACM's automatic renewal is convenient, but renewal fails if some conditions break down. If you delete the CNAME record for DNS validation, renewal can no longer be validated, so you leave this record in place without deleting it. Another prerequisite for automatic renewal is that the certificate is associated with an AWS resource and is actually in use. Certificates that are not in use may be excluded from automatic renewal. Because you are notified by an event when the expiration date approaches, you monitor this to detect missed renewals early. Operations that maintain these conditions make it easier to prevent outages caused by expired certificates.

Wildcard and Multi-Domain Certificates

With ACM, you can protect multiple host names with a single certificate. A wildcard certificate protects one level of subdomains of the same domain together, so when you add a subdomain at that level, you do not need to reissue the certificate. You can issue a multi-domain (SAN) certificate that includes different domain names in one certificate, and manage multiple related sites with one certificate. Because there is a limit on the number of domains that can be included in one certificate, when your configuration grows large, you design how to combine wildcards and individual names. Keeping the number of certificates down reduces the number of items whose renewal you manage.

Private CA and Mutual TLS

For communication between internal services that are not exposed externally, certificates issued from a private CA are suitable. Because public certificates are recorded in transparency logs and host names end up being exposed, you choose private certificates when you want to hide internal names. In addition, if you configure mutual TLS (mTLS), in which the client and server each present a certificate to authenticate each other, you can set it up so that you communicate only with permitted parties. Because a private CA costs money to maintain, you separate uses that public certificates can cover from uses that need internal authentication or mTLS, and introduce it to the extent needed.

Summary

ACM is a service that manages the issuance and renewal of public SSL/TLS certificates. When you set up DNS validation, certificates are renewed without manual work, and you can assign certificates to ALB and CloudFront. Combined with Private CA, it lets you issue certificates used for mTLS authentication of internal services.

References (Official AWS Resources)

The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.

If this page and the official documentation disagree, treat the official documentation as authoritative.

Detecting Excessive Access Permissions with IAM Access Analyzer - Analyzing External Access and Unused PermissionsDetect unused permissions on IAM roles based on CloudTrail and automatically generate least-privilege policies. This article explains external access detection and how to build custom policy checks into CI/CD.Retrieving Compliance Reports with AWS Artifact - Audit Response and Agreement ManagementLearn how to retrieve SOC, PCI DSS, and ISO audit reports on demand and apply BAA and GDPR DPA agreements across your entire AWS Organizations structure.Automating Audits - Continuously Collecting Compliance Evidence with AWS Audit ManagerLearn how to automate audit evidence collection with AWS Audit Manager. This guide covers automated assessments based on frameworks such as SOC 2, PCI DSS, and GDPR, centralized evidence management, and audit report generation.The Hidden Structure of AWS Account IDs' 12 Digits - Why 12 Digits, and What Can You Infer?A trivia-style exploration of why AWS account IDs are 12-digit numbers, the design intent embedded in the ARN structure, and the security considerations around what can be inferred from an account ID.Why the AWS Account Root User Is Dangerous - The Design Philosophy of Privilege Separation and Practical LockdownWe explain why the AWS root user holds privileges that cannot be restricted by IAM, list the operations only the root user can perform, cover MFA setup methods, and describe the lockdown strategy using Organizations' centralized root access management.Certificate Management and HTTPS - Automated TLS Certificate Operations with AWS Certificate ManagerLearn about TLS/SSL certificate issuance, automatic renewal, and deployment using AWS Certificate Manager (ACM). Covers integration with CloudFront, ALB, and API Gateway, DNS validation, and Private CA usage.Dedicated Key Management with AWS CloudHSM - FIPS 140-3 Level 3 Compliant EncryptionAchieve FIPS 140-3 Level 3 compliant key management with dedicated HSM instances. Learn when to choose CloudHSM over KMS and how to integrate both through KMS custom key stores.CloudTrail Sees Everything - How API Calls Are Recorded and Practical Forensic InvestigationThis article explains how CloudTrail records AWS API calls, the differences between management events and data events, SQL analysis with CloudTrail Lake, and forensic investigation techniques when a security incident occurs.