Security

Certificate Management and HTTPS - Automated TLS Certificate Operations with AWS Certificate Manager

Learn about TLS/SSL certificate issuance, automatic renewal, and deployment using AWS Certificate Manager (ACM). Covers integration with CloudFront, ALB, and API Gateway, DNS validation, and Private CA usage.

約 7 分で読めます

TLS Certificate Management Challenges and the Role of ACM

TLS/SSL certificates are essential for HTTPS on websites and APIs, but traditional certificate management involves significant operational overhead. Applying to a Certificate Authority (CA), verifying domain ownership, installing certificates, and most troublesome of all, renewing before expiration. Service outages caused by forgotten certificate renewals are incidents that actually occur at many organizations. AWS Certificate Manager (ACM) fundamentally solves these challenges. It issues public TLS certificates for free, and when DNS validation is configured, renewal is fully automated. ACM-issued certificates have a 13-month validity period, and automatic renewal attempts begin 60 days before expiration. As long as the DNS validation CNAME record is correctly configured, certificates continue to renew without human intervention. ACM is broadly compatible with major AWS edge and load balancer services including CloudFront, ALB, NLB, API Gateway, and App Runner.

Certificate Issuance and Validation Methods

Issuing a certificate with ACM requires only specifying the domain name and choosing a validation method. There are two validation methods - DNS validation and email validation - with DNS validation being recommended. With DNS validation, you prove domain ownership by adding a CNAME record specified by ACM to your DNS. When using Route 53, you can create the CNAME record with a single click from the management console. ```yaml # ACM certificate definition in a SAM template Resources: Certificate: Type: AWS::CertificateManager::Certificate Properties: DomainName: example.com SubjectAlternativeNames: - '*.example.com' ValidationMethod: DNS DomainValidationOptions: - DomainName: example.com HostedZoneId: !Ref HostedZone ``` By issuing a wildcard certificate (*.example.com), you can cover any subdomain such as api.example.com, www.example.com, and app.example.com with a single certificate. You can also include multiple domain names in a single certificate using Subject Alternative Names (SAN). Note that certificates used with CloudFront must be issued in the us-east-1 region. Certificates for ALB or API Gateway should be issued in the same region as the resource.

Integration with AWS Services

ACM certificates are used by directly associating them with AWS services. For CloudFront distributions, you specify an ACM certificate for HTTPS on custom domains. For ALB (Application Load Balancer), you configure an ACM certificate on the HTTPS listener, with TLS termination handled at the load balancer. SNI (Server Name Indication) allows a single ALB to use different certificates for multiple domains. API Gateway custom domains also use ACM certificates, enabling you to expose APIs on custom domains like api.example.com. App Runner also supports HTTPS on custom domains using ACM certificates. In all these services, the certificate's private key is never exposed to users and is securely managed by AWS. When certificates are automatically renewed, the changes are automatically reflected in associated services with no downtime. For a systematic understanding of certificate management, related books on Amazon can also be a useful reference.

Private CA and Advanced Use Cases

ACM Private CA (Private Certificate Authority) is a managed CA service for issuing private certificates used within an organization. It is used for mTLS (mutual TLS) authentication between internal systems, IoT device certificate management, and VPN connection authentication. Private CA costs $400 USD per month, which is expensive, but it is reasonable compared to the cost of building and operating your own CA (HSM, operations staff, audit compliance). Short-lived certificate mode allows issuing certificates with a validity period of 7 days or less, eliminating the monthly fee (only per-certificate usage charges apply). Certificate Transparency log registration is also available as an option, ensuring the same level of auditability as public certificates. ACM also supports imported certificates, allowing you to import certificates issued by other CAs (Let's Encrypt, DigiCert, etc.) into ACM for use with ALB or CloudFront. However, imported certificates are not eligible for automatic renewal, so issuing directly through ACM results in lower operational overhead.

ACM Pricing

ACM public certificates are free to issue and renew. There are no additional charges for deploying to ALB, CloudFront, or API Gateway. ACM Private CA costs approximately $400 per month per CA, with additional charges based on the number of certificates issued (approximately $0.75 per certificate for the first 1,000). For use cases that can be addressed with public certificates, leverage ACM's free certificates and limit Private CA to mTLS and internal service authentication to manage costs.

Summary - ACM Usage Guidelines

AWS Certificate Manager is a service that fully automates TLS certificate issuance, renewal, and deployment. Public certificates are free to issue, and automatic renewal via DNS validation eliminates the risk of certificate expiration. Integration with major services including CloudFront, ALB, API Gateway, and App Runner significantly lowers the barrier to HTTPS adoption. Wildcard certificates and SAN enable efficient management of multiple domains. Private CA addresses certificate management for internal systems and IoT devices, meeting enterprise security requirements. When publishing websites or APIs, adopting ACM for certificate management is recommended as a standard practice.

Related Services

AWS Certificate ManagerA service that automates provisioning, management, and deployment of SSL/TLS certificatesAmazon CloudFrontA CDN service that delivers content at high speed from edge locations around the worldElastic Load BalancingA service that automatically distributes traffic across multiple servers for high availability and fault tolerance

Related Articles

Building a WordPress Site with Amazon Lightsail - From SSL Setup to CDN DeliveryBuild a WordPress site on Lightsail, configure SSL with Let's Encrypt, and publish it globally via CDN. This article also covers backup strategies.Amazon Route 53 DNS Design - Routing Policies and Health Checks in PracticeAchieve advanced traffic control with alias records and seven routing policies. This article covers multi-region failover design using health checks.Domain Registration and DNS Migration with Amazon Route 53 - Registrar Transfers and Zone ConfigurationA comprehensive walkthrough covering domain registration, transfers from other registrars, public and private hosted zone design, and enabling DNSSEC.

More on This Topic

Detecting Excessive Permissions with IAM Access Analyzer - External Access and Unused Permission AnalysisDetect unused permissions on IAM roles using CloudTrail-based analysis and auto-generate least-privilege policies. This guide covers external access detection and integrating custom policy checks into your CI/CD pipeline.Automating SSL/TLS Certificate Management with AWS Certificate Manager - From Issuance to RotationLearn how ACM handles free public certificate issuance, DNS validation, automatic renewal, and deployment to ALB and CloudFront.Retrieving Compliance Reports with AWS Artifact - Audit Response and Agreement ManagementLearn how to retrieve SOC, PCI DSS, and ISO audit reports on demand and apply BAA and GDPR DPA agreements across your entire AWS Organizations structure.Automating Audits - Continuously Collecting Compliance Evidence with AWS Audit ManagerLearn how to automate audit evidence collection with AWS Audit Manager. This guide covers automated assessments based on frameworks such as SOC 2, PCI DSS, and GDPR, centralized evidence management, and audit report generation.The Hidden Structure of AWS Account IDs' 12 Digits - Why 12 Digits, and What Can You Infer?A trivia-style exploration of why AWS account IDs are 12-digit numbers, the design intent embedded in the ARN structure, and the security considerations around what can be inferred from an account ID.Why the AWS Account Root User Is Dangerous - The Design Philosophy of Privilege Separation and Practical LockdownWe explain why the AWS root user holds privileges that cannot be restricted by IAM, list the operations only the root user can perform, cover MFA setup methods, and describe the lockdown strategy using Organizations' centralized root access management.Dedicated Key Management with AWS CloudHSM - FIPS 140-2 Level 3 Compliant EncryptionAchieve FIPS 140-2 Level 3 compliant key management with dedicated HSM instances. Learn when to choose CloudHSM over KMS and how to integrate both through KMS custom key stores.CloudTrail Sees Everything - How API Calls Are Recorded and Practical Forensic InvestigationThis article explains how CloudTrail records AWS API calls, the differences between management events and data events, SQL analysis with CloudTrail Lake, and forensic investigation techniques when a security incident occurs.

Similar Articles and Services

AWS Certificate ManagerA service that provisions, manages, and auto-renews SSL/TLS certificates, enabling free HTTPS on CloudFront and ALBAutomating SSL/TLS Certificate Management with AWS Certificate Manager - From Issuance to RotationLearn how ACM handles free public certificate issuance, DNS validation, automatic renewal, and deployment to ALB and CloudFront.AWS Private Certificate AuthorityA managed certificate authority service for issuing and managing private certificatesBuilding a Private PKI with AWS Private CA - Automated Certificate Issuance and RotationBuild a private certificate authority and automatically issue mTLS certificates for internal service-to-service communication. Learn about certificate lifecycle management and CRL design.