What is AWS Certificate Manager?
AWS Certificate Manager (ACM) is a service for provisioning and managing public and private SSL/TLS certificates for AWS resources. The service automates certificate creation, validation, and renewal for AWS services integrated with ACM, and additionally offers ACME-based automation and exportable certificates for your own servers and infrastructure outside AWS.
Key Features
- Free public SSL/TLS certificates for ACM-integrated AWS services
- Automatic renewal before expiration as long as domain validation remains confirmed
- DNS or email-based domain validation
- ACME protocol support for automated certificate issuance on your own servers (e.g., EC2)
- Exportable public certificates (paid) for use outside AWS
- AWS Private CA for private certificate authorities and internal PKI
- Wildcard certificates for an unlimited number of subdomains
Common Use Cases
HTTPS for Web Applications: Secure websites and APIs with free SSL certificates for integrated services. Integration with CloudFront or Application Load Balancer requires no manual certificate configuration.
Multi-Domain Certificates: An ACM certificate can cover up to 10 domains (SANs) by default, with more available via a quota increase. Wildcard certificates (*.example.com) automatically secure all subdomains.
Private PKI for Enterprises: AWS Private CA creates a private Certificate Authority for internal applications, IoT devices, or microservices communication with full control over the certificate chain and exportable certificates.
Benefits
- No cost for public certificates on AWS services
- Automated renewal processes for integrated services
- Native integration with AWS load balancers and CDN
- Flexible options for certificates outside AWS via ACME or export
- Audit logs via AWS CloudTrail
Integration with innFactory
As an AWS Reseller, innFactory supports you with AWS Certificate Manager: architecture for secure TLS communication, building private PKI infrastructure, and migrating existing certificates to ACM.
Typical Use Cases
Frequently Asked Questions
Are ACM certificates really free?
Public certificates for AWS services integrated with ACM (e.g., CloudFront, load balancers, API Gateway) are free. Exportable public certificates, ACME certificates for your own servers, and private certificates via AWS Private CA are paid options.
Which AWS services does ACM support?
ACM certificates work natively with CloudFront, Elastic Load Balancing, API Gateway, Elastic Beanstalk, and CloudFormation. For your own servers or EC2 instances, exportable certificates or ACME-based automation are available.
How does automatic renewal work?
ACM automatically renews certificates for integrated AWS services before expiration, provided domain validation can still be confirmed. With DNS validation, no manual action is typically required.
Can I export ACM certificates?
Free public certificates for integrated services cannot be exported. Paid exportable public certificates and private certificates via AWS Private CA can be exported and used on any servers.
How many domains can a certificate cover?
An ACM certificate can cover up to 10 domain names (SANs) by default; this limit can be increased up to 100 via a quota increase. Wildcard certificates additionally protect an unlimited number of subdomains.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of AWS (official documentation). This page does not represent an offer by AWS.