AWS Certificate Manager Essential2016年〜
A service that automates provisioning, management, and deployment of SSL/TLS certificates
What It Does
AWS Certificate Manager (ACM) is a service that issues SSL/TLS certificates for free and automatically renews them for use with your websites and applications. You can deploy certificates to AWS services like CloudFront, Elastic Load Balancing, and API Gateway with a single click. ACM frees you from managing certificate expiration dates and renewal tasks, making it easy to enable HTTPS communication.
Use Cases
ACM is used for enabling HTTPS on websites, encrypting API endpoint communications, configuring CloudFront distributions with custom domains, and SSL termination on load balancers. You can also cover multiple domains and subdomains with a single certificate.
Everyday Analogy
Think of it like an automatic driver's license renewal service. Normally, SSL certificates have an expiration date, and when they expire, your website displays a "not secure" warning. ACM issues your license (certificate) for free and automatically renews it before it expires. You never have to worry about forgetting to renew and having it lapse.
What Is ACM?
AWS Certificate Manager (ACM) is a service that automates the issuance, management, and deployment of SSL/TLS certificates. SSL/TLS certificates are required to encrypt communication between websites and browsers - any site whose URL starts with "https://" uses one of these certificates. With ACM, you can build a secure communication environment without the hassle of purchasing certificates or manually renewing them.
Certificate Issuance and Validation
To issue a certificate with ACM, you specify the target domain name and submit a request. You then verify domain ownership through either DNS validation or email validation. For DNS validation, you simply add a specified CNAME record to your domain's DNS. If you're using Route 53, you can add the DNS record with a single button click, and the certificate is issued within minutes.
How Auto-Renewal Works
Certificates issued by ACM have a 13-month validity period and are automatically renewed as the expiration date approaches. When using DNS validation, renewal is fully automatic as long as the CNAME record remains in place. No manual renewal work is required at all. This fundamentally prevents the common issue of site downtime caused by expired certificates. You can also learn practical tips on auto-renewal from books on Amazon.
Getting Started
In the ACM console, click "Request a certificate" and select a public certificate. Enter the domain names you want to protect (e.g., example.com, *.example.com), choose DNS validation, and submit the request. Once you add the CNAME record to your DNS and validation completes, the certificate is issued. Then simply select the issued certificate in your CloudFront or ALB configuration.
Things to Watch Out For
- Public certificates issued by ACM are free, but certificates used with CloudFront must be issued in the us-east-1 region
- ACM certificates can only be used with AWS services (CloudFront, ALB, API Gateway, etc.) and cannot be installed directly on EC2 instances
- Wildcard certificates (*.example.com) let you cover all subdomains with a single certificate
