AWS Certificate Manager now supports ACME issuance through AWS PrivateLink
AWS Certificate Manager now supports AWS PrivateLink for ACME public certificate issuance, enabling TLS certificate requests and renewals over a private network path within AWS
AWS Certificate Manager (ACM) now supports AWS PrivateLink for ACME public certificate issuance, enabling public TLS certificate requests and renewals over private networks within the AWS network. Create a VPC interface endpoint from ACMEv2-compatible clients to route issuance traffic inside the VPC. No changes to existing ACME client configurations are required; simply create an ACM-managed ACME endpoint and a standard VPC interface endpoint using the VPC console, AWS CLI, or AWS CloudFormation. Private DNS automatically resolves existing ACME directory URLs to the interface endpoint within the VPC, allowing the same client configurations and directory URLs to continue working without reconfiguration. Issuance operations (account creation, order creation, domain validation, finalization, certificate retrieval) are executed via PrivateLink, with all activities visible in the ACM console and auditable through AWS CloudTrail logs and Amazon CloudWatch metrics. This support for ACME certificate issuance via AWS PrivateLink is available in all commercial AWS regions. Standard AWS PrivateLink charges apply to interface endpoints. For details on ACM pricing, see the ACM pricing page.
Why it matters
This change affects users who issue TLS certificates using ACME. It enables certificate issuance over a private network path, improving security and control
Regions: All Regions