AWS Certificate Manager Basicsince 2016
A service that automates provisioning, management, and deployment of SSL/TLS certificates
What It Does
AWS Certificate Manager (ACM) is a service that issues SSL/TLS certificates for free and automatically renews them for use with your websites and applications. You can deploy certificates to AWS services like CloudFront, Elastic Load Balancing, and API Gateway with a single click. ACM frees you from managing certificate expiration dates and renewal tasks, making it easy to enable HTTPS communication.
Use Cases
ACM is used for enabling HTTPS on websites, encrypting API endpoint communications, configuring CloudFront distributions with custom domains, and SSL termination on load balancers. You can also cover multiple domains and subdomains with a single certificate.
Everyday Analogy
Think of it like an automatic driver's license renewal service. Normally, SSL certificates have an expiration date, and when they expire, your website displays a "not secure" warning. ACM issues your license (certificate) for free and automatically renews it before it expires. You never have to worry about forgetting to renew and having it lapse.
What Is ACM?
AWS Certificate Manager (ACM) is a service that automates the issuance, management, and deployment of SSL/TLS certificates. SSL/TLS certificates are required to encrypt communication between websites and browsers - any site whose URL starts with "https://" uses one of these certificates. With ACM, you can build a secure communication environment without the hassle of purchasing certificates or manually renewing them.
Certificate Issuance and Validation
To issue a certificate with ACM, you specify the target domain name and submit a request. You then verify domain ownership through either DNS validation or email validation. For DNS validation, you simply add a specified CNAME record to your domain's DNS. If you're using Route 53, you can add the DNS record with a single button click, and the certificate is issued within minutes.
How Auto-Renewal Works
Certificates issued by ACM have a 13-month validity period and are automatically renewed as the expiration date approaches. When using DNS validation, renewal is fully automatic as long as the CNAME record remains in place. No manual renewal work is required at all. This fundamentally prevents the common issue of site downtime caused by expired certificates.
Getting Started
In the ACM console, click "Request a certificate" and select a public certificate. Enter the domain names you want to protect (e.g., example.com, *.example.com), choose DNS validation, and submit the request. Once you add the CNAME record to your DNS and validation completes, the certificate is issued. Then simply select the issued certificate in your CloudFront or ALB configuration.
Things to Watch Out For
- Public certificates issued by ACM are free, but certificates used with CloudFront must be issued in the us-east-1 region
- Standard ACM public certificates do not allow private key export and are designed to be associated with AWS services (CloudFront, ALB, API Gateway, etc.). With the paid exportable public certificates added in June 2025 (198-day validity), you can also install certificates on EC2 instances or on-premises servers (as of August 2026)
- Wildcard certificates (*.example.com) let you cover all subdomains with a single certificate
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
If this page and the official documentation disagree, treat the official documentation as authoritative.
