AWS Certificate Manager
A service that provisions, manages, and auto-renews SSL/TLS certificates, enabling free HTTPS on CloudFront and ALB
Overview
AWS Certificate Manager (ACM) is a service that handles the issuance, management, deployment, and automatic renewal of SSL/TLS certificates. Public certificates issued by ACM are free and can be associated with AWS services such as CloudFront, Elastic Load Balancing, and API Gateway with a single click. After verifying domain ownership through DNS validation or email validation, certificates are automatically issued and renewed before expiration, preventing service outages caused by expired certificates. Pricing structures and certificate validity periods can change, so the details here reflect the state as of September 2026.
Certificate Issuance Flow and How DNS Validation Works
To issue a public certificate with ACM, you first create a request specifying the target domain names (e.g., example.com, *.example.com). You then choose either DNS validation or email validation to prove domain ownership. Configurations that rely on automatic renewal use DNS validation, which removes the approval step at each renewal. With DNS validation, you simply add a CNAME record specified by ACM to your domain's DNS, and as long as this record exists, automatic certificate renewal is handled seamlessly. If you use Route 53, you can add the CNAME record with a single click from the ACM console. Email validation sends a confirmation email to the domain administrator's address and requires email approval for each renewal, increasing operational overhead. Issuing a wildcard certificate (*.example.com) eliminates the need to manage individual certificates for each subdomain. Certificates issued by ACM are signed by Amazon Trust Services as the Certificate Authority (CA) and are trusted by major browsers and operating systems. Let's Encrypt also provides free certificates; ACM is chosen when integration with AWS services and managed automatic renewal matter.
Deploying Certificates to AWS Services and Managing Auto-Renewal
Certificates issued by ACM are used by associating them with CloudFront distributions, Application Load Balancers (ALB), Network Load Balancers (NLB), and API Gateway custom domains. A common pitfall is that certificates used with CloudFront must be issued in the us-east-1 region. For ALB and NLB, the standard configuration associates certificates with listeners to perform HTTPS termination at the load balancer. Multiple certificates can be associated with a single listener, with the appropriate certificate automatically selected via SNI (Server Name Indication). Auto-renewal is started by ACM as the certificate's expiration date approaches (as of September 2026, up to 60 days before expiration), and if the DNS validation CNAME record is correctly configured, renewal completes without any manual intervention. Renewal status can be monitored through the ACM console or EventBridge events, and you can set up alerts for renewal failures.
Private Certificates and Using Certificates with EC2
ACM Private CA (Certificate Authority) lets you issue private certificates for internal use within your organization. It covers use cases that public certificates cannot address, such as mTLS (mutual TLS) authentication between microservices, HTTPS for internal systems, and certificate management for IoT devices. Operating a private CA incurs a monthly fee, but the benefit of centrally managing a large number of certificates is significant. Standard ACM public certificates are designed so the private key cannot be exported, which means they cannot be installed directly on web servers (Nginx, Apache) running on EC2 instances. To terminate HTTPS on EC2, the basic approaches are to place an ALB in front and associate the ACM certificate with the ALB, or to use the ACM integration for Nitro Enclaves. Exportable public certificates are also offered, opening up the option of installing certificates directly on EC2 or on-premises servers. As of September 2026, the maximum validity period of a public certificate is 198 days. Check their validity period, pricing, and availability conditions in the AWS documentation and pricing pages. For certificate management in CloudFormation, you can declaratively define certificates using the AWS::CertificateManager::Certificate resource, but the DNS validation CNAME record creation must be defined separately as a Route 53 resource. When sharing certificate ARNs across stacks, exporting them to SSM Parameter Store makes cross-region references straightforward.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon CloudFront official page
- Elastic Load Balancing official page
- Amazon API Gateway official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.