AWS Certificate Manager

By the end of this lesson you will be able to

• Explain what AWS Certificate Manager (ACM) does: provision, store, renew and deploy TLS certificates for HTTPS, with free public certificates and a private key that never leaves AWS.
• Name the services that can use an ACM certificate (ELB, CloudFront, API Gateway, App Runner, Amplify, Nitro Enclaves and others), and say why a normal ACM certificate cannot be installed on an EC2 instance.
• Request a public certificate with DNS or email validation, and explain why DNS validation is the answer for renewal “without human intervention”.
• Describe managed renewal (198-day certificates renewed 45 days before expiry) and what makes it fail.
• Import a third-party certificate, and monitor its expiry with ACM’s EventBridge events and the AWS Config rule acm-certificate-expiration-check.
• Attach certificates to an ALB HTTPS listener with an HTTP → HTTPS redirect and SNI, and say which load balancers support SNI.
• Pick the right Region for a certificate: us-east-1 for CloudFront and edge-optimized API Gateway domains, the resource’s own Region for Regional APIs and load balancers.

#Why ACM: HTTPS without the certificate chores

Lesson 21.1 explained encryption in flight: TLS (still called SSL in many exam questions) encrypts the traffic between a client and a server, and the server proves who it is with a certificate. Lesson 6.4 showed what a certificate contains (domain names, public key, validity dates, a CA’s signature) and how a load balancer uses it. This lesson is about the service that gets you those certificates and keeps them alive.

#The problem

A university in Rajshahi runs its admission portal, its results site and a mobile API on AWS. Each needs HTTPS, each needs a certificate, and certificates expire. The old routine: generate a key and a CSR on a server, buy a certificate, wait for an email, copy the certificate, key and chain to every server, restart the web servers, and write the expiry date in a calendar. Then, one year later, the person who did it has left, nobody renews, and on result day every student sees a full-page browser warning instead of their marks.

Expired certificates are one of the most common causes of outages, at banks, telcos and big tech companies alike. And certificates are getting shorter, so renewals come more often (side note below).

#What ACM is

AWS Certificate Manager (ACM) is a managed service that lets you provision, manage and deploy TLS certificates for AWS services:

• Public certificates are free. A public certificate from ACM is issued by Amazon’s public certificate authority (Amazon Trust Services) and trusted by all major browsers. You pay nothing for it when you use it with integrated services.
• Automatic renewal. ACM renews the certificates it issued, and pushes the renewed certificate to every service that uses it, under the same ARN.
• The private key stays inside AWS. ACM generates and protects the key; you never download it (exportable certificates are a paid exception, below).
• Public and private certificates. Public ones for internet-facing sites; private ones for internal services, signed by your own AWS Private CA (side note later in this lesson).
• Regional. A certificate belongs to one Region and can only be used by resources in that Region. CloudFront is the exception that proves the rule: it uses certificates from us-east-1.
• Central view and audit. One list of certificates, their status, expiry and which resources use them, and every API call recorded in CloudTrail (lesson 19.6).

Every public ACM certificate is DV (domain validated): it proves control of the domain names, nothing about the organisation. A certificate can hold several names (up to 10 by default, adjustable to 100), including a wildcard such as *.example.com. A wildcard covers exactly one level (admission.example.com, not a.b.example.com) and does not cover the apex example.com; request both example.com and *.example.com if you need both.

#Where an ACM certificate can be used

ACM certificates are attached to integrated services, which complete the TLS handshake on your behalf:

The slides list the three the exam cares about: Elastic Load Balancers (CLB, ALB, NLB), CloudFront distributions and APIs on API Gateway.

What is not on the list: a plain EC2 instance. A normal ACM certificate’s private key cannot be exported, so you cannot put it in Nginx, Apache or IIS on an instance. The standard design is to terminate TLS on an ALB (or CloudFront) in front of the instances. If the instance itself must hold a certificate (end-to-end encryption to the target), it uses a certificate from somewhere else: a self-signed one is fine behind an ALB, because the ALB does not validate target certificates (lesson 6.4).

#Requesting a public certificate

1. List the domain names

   Give a fully qualified domain name such as admission.example.com, a wildcard such as *.example.com, or several names on one certificate (the apex example.com plus *.example.com is the common pair). Choose the key algorithm: RSA 2048 (the default and most compatible) or ECDSA P-256 / P-384 (smaller and faster, supported by modern clients).

2. Choose the validation method

   DNS validation (recommended) or email validation. You prove that you control every name on the certificate.

3. Wait for validation

   The status is Pending validation until ACM finds the proof. With DNS in Route 53 this usually takes minutes (the slide says it can take a few hours). If the proof is not found within 72 hours, the request times out and you request again.

4. Issued and enrolled for renewal

   The status becomes Issued. The certificate can now be attached to integrated services and is enrolled in managed renewal.

#DNS validation and email validation

The CNAME looks like this:

_3639ac514e785e898d2646601fa951d5.admission.example.com.  CNAME  _98d2646601fa951d5a1b2c3d4e5f6a7b.xlfgrmvvlj.acm-validations.aws.

Only someone who can edit the zone can create a record under your domain, so its presence proves control. The same record is reused for every renewal, which is why the rule is never delete the validation CNAME while the certificate is in use. CNAME records themselves are in lesson 8.1. If the zone has CAA records (which CAs may issue for the domain), they must allow amazon.com, amazontrust.com, awstrust.com or amazonaws.com, or ACM cannot issue or renew.

For email validation ACM writes to five fixed addresses of the domain: admin@, administrator@, hostmaster@, postmaster@ and webmaster@. The link in each email expires after 72 hours. You cannot switch an existing certificate from email to DNS validation; you request a new one.

#Managed renewal

ACM public certificates are now issued with a validity of 198 days. Forty-five days before expiry ACM tries to renew. For a DNS-validated certificate it checks two things:

1. The certificate is in use by an AWS service (attached to a load balancer, distribution, API…), or has been exported.
2. Every validation CNAME is still present and resolvable in public DNS.

If both are true, ACM issues a new certificate with the same ARN and deploys it to every service that uses it. Nothing changes in your listener or distribution, and nobody needs to log in.

If ACM cannot validate, it sends AWS Health and EventBridge events at 30, 15, 7, 3 and 1 day before expiry (the “Renewal Action Required” event carries the reason, for example PENDING_DOMAIN_VALIDATION or CAA_ERROR). A certificate that is not in use and not exported is not renewed at all: unused certificates are simply left to expire.

For email-validated certificates, ACM emails the five addresses 45 days before expiry and renews only after someone clicks.

#Importing a third-party certificate

ACM can also store certificates you got elsewhere. Reasons to import:

• A partner or regulator requires a certificate from a specific commercial CA, or an OV or EV certificate (ACM only issues DV).
• You already bought a multi-year contract with a CA such as GoDaddy or Sectigo, or you use Let’s Encrypt through your own tooling.
• You need the same certificate on AWS and on servers outside AWS.

You import three PEM-encoded pieces: the certificate, its private key (unencrypted, RSA or ECDSA) and the certificate chain. ACM checks that they belong together but does no domain validation: that was the CA’s job. Importing is free, and the imported certificate is used exactly like an ACM-issued one.

The catch is the exam’s favourite fact about ACM: ACM never renews an imported certificate. It did not issue it and has no relationship with that CA. Before it expires, you must get a new certificate from the CA and re-import it into the same ARN; every load balancer or distribution that uses that ARN then picks up the new one automatically.

#Knowing before it expires

Two mechanisms, both on the slide:

• ACM expiry events in EventBridge. ACM sends an “ACM Certificate Approaching Expiration” event every day, starting 45 days before expiry for imported (and private) certificates. The number of days is an account setting (aws acm put-account-configuration, between 1 and 45). An EventBridge rule sends the event to SNS (email or chat to the team), a Lambda function (open a ticket, or fetch the new certificate from the CA and re-import it), or SQS. For ACM-issued public certificates the daily events start at 30 days, since ACM renews those itself.
• AWS Config managed rule acm-certificate-expiration-check. Config evaluates every ACM certificate periodically and on changes, and marks it NON_COMPLIANT when it expires within the number of days you configure (14 by default). Config gives a compliance dashboard across accounts and Regions, and its compliance changes are events too, routed by EventBridge. Config is taught in lesson 19.7, EventBridge in lesson 19.5.

The “ACM Certificate Expired” event exists only for ACM-issued certificates, not for imported ones, so do not wait for that event to tell you an imported certificate is gone.

#ACM with an Application Load Balancer

The most common place for an ACM certificate is an ALB’s HTTPS listener:

• The listener on port 443 uses an ACM certificate (from the ALB’s own Region) and a security policy that sets the allowed TLS versions and ciphers. TLS terminates at the ALB: it decrypts, applies its listener rules, and forwards to targets over HTTP, or re-encrypts to HTTPS if your rules require encryption on every hop (termination vs re-encryption is in lesson 6.4).
• A listener on port 80 has a single rule: redirect to HTTPS (HTTP 301). That is the slide’s “HTTP → HTTPS redirect rule”, and it makes sure no page is ever served unencrypted.
• The instances in the Auto Scaling group need no public certificate and no TLS work, which saves CPU and gives one place to manage certificates.

#SNI: many sites, many certificates, one ALB

One ALB can serve admission.example.com and results.example.com, each with its own certificate. The listener has one default certificate and a certificate list (up to 25 extra certificates by default). The browser puts the hostname in the SNI field of its first TLS message (the ClientHello), and the ALB answers with the matching certificate. If the client sends no SNI, or no certificate matches, the ALB uses the default certificate, which usually means a name-mismatch error for that client. After decryption, a host-header rule chooses the target group. The mechanism and the handshake are taught in lesson 6.4; here we look at it from the certificate side.

#API Gateway endpoint types

An API Gateway API lives in one Region. Its endpoint type decides how clients reach it (full detail in lesson 15.6):

Edge-optimized still runs the API in one Region and does not cache responses at the edge; it shortens the network path. Interface endpoints are lesson 22.2.

#ACM with API Gateway custom domains

The default address of an API looks like a1b2c3d4e5.execute-api.ap-south-1.amazonaws.com. For a clean api.example.com you create a custom domain name in API Gateway, map it to the API and stage, and give it an ACM certificate. The certificate’s Region depends on who completes the TLS handshake:

• Edge-optimized custom domain → the certificate must be in us-east-1 (N. Virginia), whatever Region the API is in, because the domain is served by a CloudFront distribution and CloudFront reads certificates only from us-east-1.
• Regional custom domain → the certificate must be in the same Region as the API (the slide: “the same region as the API Stage”).
• Then point the name at the custom domain’s target in Route 53, with a CNAME or (better) an alias A/AAAA record (alias vs CNAME: lesson 8.2).

The same rule, written once for everything:

One more consequence of “Regional”: the same domain served in two Regions needs two certificates, one in each Region, each renewed separately. ACM does not copy certificates between Regions. CloudFront’s own certificate rules are in lesson 11.1.

Try the rule on any combination: pick where TLS ends and the Region, and see where the certificate must live.

#Private certificates: AWS Private CA

Public certificates are for names on the internet. For internal names (orders.internal.example, a service mesh, mutual TLS between microservices, IoT devices, VPN clients), companies run their own private certificate authority, whose certificates only their own machines trust.

AWS Private CA (formerly ACM Private CA) is that CA as a managed service: you create a root and subordinate CAs, their keys are kept in hardware security modules, and you issue private certificates through ACM or directly. Private certificates requested through ACM can be attached to integrated services and are renewed automatically; private certificates can also be exported for your own servers. It is not free: about 400 USD per CA per month in general-purpose mode (50 USD in short-lived certificate mode, for certificates valid up to 7 days), plus a price per certificate. Browsers do not trust private certificates, so they are never the answer for a public website. On the exam: “internal TLS with your own CA, managed by AWS” → AWS Private CA.

#What goes wrong

• A certificate “not found” in the console. It is in the wrong Region: us-east-1 for CloudFront and edge-optimized APIs, the resource’s Region otherwise.
• Stuck in Pending validation, then Validation timed out. The CNAME was added to the wrong zone (a private hosted zone, or a zone the domain does not delegate to), with a typo, or with the domain doubled by the DNS provider (_x.example.com.example.com). Or a CAA record does not allow Amazon. Requests time out after 72 hours.
• Renewal fails months later. The validation CNAME was deleted, the domain moved to another DNS provider without the record, the certificate is not in use (so ACM does not renew it), or email-validated renewal mails went unread. Watch for “Renewal Action Required” events.
• Imported certificate expires. ACM never renews imported certificates; nobody routed the expiry events. Use EventBridge or the Config rule, or switch to an ACM-issued certificate.
• Name mismatch errors. The certificate does not cover the name (a wildcard does not cover the apex or a second level), the client sends no SNI and gets the default certificate, or a CLB can hold only one certificate.
• “Install the ACM certificate on the instances.” Not possible with a normal certificate. Terminate TLS at an ALB or CloudFront; use a self-signed or private certificate on the targets if you need encryption on the last hop.
• Cannot delete a certificate. It is still in use. ACM refuses to delete a certificate associated with a load balancer, distribution or custom domain; remove the association first.
• Too many certificates. Each account has a quota of ACM certificates per Region (2,500 by default) and a yearly limit on requests; CloudFormation stacks that create a certificate per environment can hit it.

#ACM in system design

• The standard web front door. Route 53 alias → CloudFront (ACM certificate in us-east-1) → ALB (its own ACM certificate in its Region) → instances or containers. Two certificates, both free, both renewed by ACM.
• Many tenants on one entry point. A SaaS with a domain per customer uses SNI on an ALB (up to 25 extra certificates by default per load balancer) or CloudFront, instead of one load balancer per customer.
• Multi-Region active-active. Each Region’s ALB or Regional API has its own certificate for the same name, each DNS-validated with the same CNAME, and Route 53 latency or failover routing in front.
• Infrastructure as code. CloudFormation AWS::CertificateManager::Certificate with DNS validation and a hosted zone ID creates the certificate and its validation record in the same stack, so a new environment gets HTTPS with no manual step.
• Governance. One security team monitors expiry across all accounts with the Config rule (aggregated in an Organization, lesson 20.1) and EventBridge rules; IAM policies can restrict who may request, import or delete certificates.
• Encryption on every hop. CloudFront → ALB with ACM certificates, ALB → targets with private certificates from AWS Private CA, or an NLB with TLS passthrough when the application must hold its own keys.

#Try it yourself

These commands use the AWS CLI v2. Public certificates are free; the Route 53 hosted zone costs 0.50 USD a month. Replace example.com with a domain you control.

# 1. Request a public certificate with DNS validation, for the apex and a wildcard
aws acm request-certificate --region ap-southeast-1 \
  --domain-name example.com --subject-alternative-names '*.example.com' \
  --validation-method DNS --key-algorithm RSA_2048
# { "CertificateArn": "arn:aws:acm:ap-southeast-1:111122223333:certificate/1234abcd-12ab-34cd-56ef-1234567890ab" }

ARN=arn:aws:acm:ap-southeast-1:111122223333:certificate/1234abcd-12ab-34cd-56ef-1234567890ab

# 2. Read the CNAME that proves control (one record covers example.com and *.example.com)
aws acm describe-certificate --region ap-southeast-1 --certificate-arn $ARN \
  --query 'Certificate.DomainValidationOptions[0].ResourceRecord'
# { "Name": "_3639ac514e785e898d2646601fa951d5.example.com.",
#   "Type": "CNAME",
#   "Value": "_98d2646601fa951d5a1b2c3d4e5f6a7b.xlfgrmvvlj.acm-validations.aws." }

# 3. Create it in Route 53, then wait until ACM has validated and issued the certificate
aws route53 change-resource-record-sets --hosted-zone-id Z0123456789EXAMPLE --change-batch '{
  "Changes": [{ "Action": "UPSERT", "ResourceRecordSet": {
    "Name": "_3639ac514e785e898d2646601fa951d5.example.com.", "Type": "CNAME", "TTL": 300,
    "ResourceRecords": [{ "Value": "_98d2646601fa951d5a1b2c3d4e5f6a7b.xlfgrmvvlj.acm-validations.aws." }] } }] }'
aws acm wait certificate-validated --region ap-southeast-1 --certificate-arn $ARN
aws acm describe-certificate --region ap-southeast-1 --certificate-arn $ARN \
  --query 'Certificate.[Status,NotAfter,RenewalEligibility,InUseBy]'
# [ "ISSUED", "2027-05-17T23:59:59+00:00", "INELIGIBLE", [] ]
#   (INELIGIBLE until it is attached to something: unused certificates are not renewed)

# 4. HTTPS listener on an ALB with that certificate, and a port 80 listener that redirects
aws elbv2 create-listener --load-balancer-arn $ALB_ARN --protocol HTTPS --port 443 \
  --certificates CertificateArn=$ARN --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06 \
  --default-actions Type=forward,TargetGroupArn=$TG_ARN
aws elbv2 create-listener --load-balancer-arn $ALB_ARN --protocol HTTP --port 80 \
  --default-actions 'Type=redirect,RedirectConfig={Protocol=HTTPS,Port=443,StatusCode=HTTP_301}'

# 5. A second site on the same listener: add its certificate to the SNI list
aws elbv2 add-listener-certificates --listener-arn $LISTENER_ARN \
  --certificates CertificateArn=$RESULTS_CERT_ARN

# 6. See which certificate the ALB presents for each name (and without SNI)
openssl s_client -connect results.example.com:443 -servername results.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -enddate
# subject=CN = results.example.com
# notAfter=May 17 23:59:59 2027 GMT
openssl s_client -connect results.example.com:443 -noservername </dev/null 2>/dev/null \
  | openssl x509 -noout -subject
# subject=CN = admission.example.com     <- the default certificate

# 7. Import a third-party certificate, and re-import its renewal into the same ARN later
aws acm import-certificate --region ap-southeast-1 \
  --certificate fileb://pay_example_com.crt --private-key fileb://pay_example_com.key \
  --certificate-chain fileb://ca-chain.pem
aws acm import-certificate --region ap-southeast-1 --certificate-arn $IMPORTED_ARN \
  --certificate fileb://pay_example_com_2027.crt --private-key fileb://pay_example_com_2027.key \
  --certificate-chain fileb://ca-chain.pem

# 8. Start the daily expiry events 30 days before expiry instead of 45, and route them to SNS
aws acm put-account-configuration --region ap-southeast-1 \
  --expiry-events DaysBeforeExpiry=30 --idempotency-token cfg2026
aws events put-rule --region ap-southeast-1 --name acm-expiry \
  --event-pattern '{"source":["aws.acm"],"detail-type":["ACM Certificate Approaching Expiration"]}'
aws events put-targets --region ap-southeast-1 --rule acm-expiry \
  --targets Id=1,Arn=arn:aws:sns:ap-southeast-1:111122223333:it-alerts

# 9. The AWS Config managed rule, flagging certificates that expire within 30 days
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "acm-certificate-expiration-check",
  "Source": { "Owner": "AWS", "SourceIdentifier": "ACM_CERTIFICATE_EXPIRATION_CHECK" },
  "InputParameters": "{\"daysToExpiration\":\"30\"}",
  "Scope": { "ComplianceResourceTypes": ["AWS::ACM::Certificate"] } }'

# 10. Custom domains for API Gateway: edge-optimized needs a us-east-1 certificate, Regional a local one
aws apigateway create-domain-name --domain-name api.example.com \
  --endpoint-configuration types=EDGE \
  --certificate-arn arn:aws:acm:us-east-1:111122223333:certificate/abcd1234-ab12-cd34-ef56-abcdef123456
aws apigateway create-domain-name --region ap-south-1 --domain-name api-in.example.com \
  --endpoint-configuration types=REGIONAL \
  --regional-certificate-arn arn:aws:acm:ap-south-1:111122223333:certificate/1a2b3c4d-1234-5678-9abc-1a2b3c4d5e6f
# Edge-optimized returns a "distributionDomainName" (d111111abcdef8.cloudfront.net),
# Regional a "regionalDomainName" (d-abc123xyz0.execute-api.ap-south-1.amazonaws.com):
# point a Route 53 alias record at it.

Also try in the console: open the certificate in ACM and look at Renewal status, In use and Associated resources; then try to delete a certificate that is in use and read the error.

#Summary

Key takeaways

• ACM provisions, manages and deploys TLS certificates for HTTPS. Public certificates are free, issued by Amazon’s CA, DV only, and renewed automatically; the private key stays in AWS.
• Integrated services: ALB, NLB, CLB, CloudFront, API Gateway (exam list), plus App Runner, Amplify, Beanstalk, Cognito, Nitro Enclaves and others. Not a plain EC2 instance: put an ALB or CloudFront in front. Exportable certificates (paid, 2025) and ACME (2026) are side notes.
• Validation: DNS (a CNAME, one click in Route 53, automatic renewal, best practice) vs email (five admin addresses, a human clicks at issue and at every renewal). “Renewal without human intervention” → DNS validation.
• Renewal: 198-day certificates, renewed 45 days before expiry if the certificate is in use and the CNAME is still there; same ARN, redeployed automatically. Failures raise events at 30, 15, 7, 3 and 1 day.
• Imported certificates are never renewed by ACM. Re-import before expiry. Monitor with daily EventBridge events from 45 days (configurable) and the Config rule acm-certificate-expiration-check.
• ALB: HTTPS listener with an ACM certificate from the ALB’s Region, port 80 → 443 redirect, TLS terminates at the ALB. SNI for many domains and certificates on one listener: ALB, NLB, CloudFront, API Gateway yes; CLB no.
• API Gateway endpoints: edge-optimized (global clients, CloudFront in front), Regional (same Region, or your own CloudFront), private (VPC interface endpoint + resource policy).
• Certificate Region rule: us-east-1 for CloudFront and edge-optimized custom domains; the same Region for Regional APIs and load balancers. Certificates are Regional and not copied between Regions.
• AWS Private CA for internal, private certificates (paid per CA per month).

Self-check: AWS Certificate Manager31 questions