PlayCloudLabs
Sign in
  1. Learn
  2. AWS
  3. Security, identity & compliance
  4. ACM
AWSGCP laterAzure later

ACMAWS Certificate Manager

Security, identity & complianceCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

Issues, stores and renews the TLS certificates for your load balancers and CloudFront distributions. Public certificates for those services cost nothing.

In the examsSolutions Architect – AssociateMEDSolutions Architect – ProfessionalLOWDeveloper – AssociateLOWSysOps Administrator – AssociateMEDSecurity – SpecialtyHIGH

Where ACM takes you5 steps, all open

  1. I know the problem it solves
  2. I can picture it
  3. I know when to choose it
  4. I can use it in a design
  5. I can answer an exam question

What & why

HTTPS without the calendar reminders

ACM handles the SSL/TLS certificates that HTTPS needs: creating them, storing them with their keys, and renewing them. It can issue a public certificate that browsers trust, a private one signed by AWS Private CA for internal names, or take one you got elsewhere as an import.

It works through integrated services. You attach the certificate to a load balancer or a CloudFront distribution, and ACM renews the ones it issued before they expire. Public certificates for those services cost nothing extra.

Reach for it when

  • a load balancer or a CloudFront distribution needs HTTPS
  • nobody wants to track expiry dates and renew by hand
  • one certificate should cover many subdomains: a wildcard
  • internal services need private certificates from your own CA

It is the wrong tool when

  • you need keys to encrypt data: that is KMS
  • a trusted certificate must sit on your own EC2 web server: that is ACME automation, or an exportable certificate, which is charged

Mental model

A passport office that renews by post

To get a passport you prove who you are, and it expires after a set time. ACM checks that you control a domain, issues the certificate, and, as long as the proof is still on file and the certificate is in use, renews it before it expires without being asked.

Proving who you areproving you control the domainDomain validation
A note left at your addressa record ACM asks you to add to DNSDNS validation
The passporta certificate browsers trustPublic certificate
An office badgetrusted only by your own systemsPrivate certificate
Renewal by postrenewed while the proof stays in placeManaged renewal
A pass for every room on one floorone level of subdomainsWildcard

How it works

Request, prove, attach, renew
  1. Request itIn the Region where it will be used, for one name or several: www.example.com, a wildcard like *.example.com, or both the apex and the wildcard.
  2. Prove you control itAdd the CNAME record ACM gives you to the domain's DNS, or answer an email. If Route 53 hosts the domain, the console creates the record for you.
  3. Attach itTo a load balancer's HTTPS listener or a CloudFront distribution. For CloudFront, the certificate must be in US East (N. Virginia).
  4. Let it renewACM renews a DNS-validated certificate by itself while it is in use and the CNAME record is still in place.
Valid for
198 dayspublic ACM certificates
Renewal starts
45 daysbefore a 198-day certificate expires
Validation window
72 hoursbefore a request times out
Wildcard
One levelnever the apex itself
For CloudFront
us-east-1the only Region it reads
Charge
Nonepublic certificates on integrated services
  1. Region

    Is it in the resource's Region? CloudFront reads certificates only from us-east-1.

  2. Validation

    Has ACM seen proof that you control every name on it?

  3. In use

    Is it attached to an integrated service, such as a load balancer or a distribution?

  4. Renewal

    45 days before expiry, ACM checks the certificate is in use and every CNAME record is still in DNS, then renews it.

Pick a case to follow the certificate through each check.

Architecture

Two certificates for one site

Architecture

CloudFront reads its certificate from us-east-1, and the load balancer uses one in its own Region.

CloudFront reads its certificate from us-east-1, and the load balancer uses one in its own Region.

Certificates are regional, and cannot be copied between Regions. A name used in two Regions needs a certificate in each. With DNS validation, the same CNAME record validates both, because the token works in any Region.

One listener, several sites. A load balancer's HTTPS listener holds a default certificate and a list of others, and picks the one that matches the host name the client asks for.

Security

Keys, validation and trust

Certificates for integrated services stay with those services. For a publicly trusted certificate on your own server, such as an EC2 instance, AWS points you to ACME automation, or to an exportable public certificate, which is charged.

Validate by DNS. A DNS-validated certificate renews by itself. Email validation depends on someone answering a renewal email in time, and a certificate cannot be switched from email to DNS validation later.

Key algorithms. ACM issues certificates with RSA 2048-bit or ECDSA 256-bit and 384-bit keys. ECDSA keys are smaller for the same strength, but not every client supports them.

Private certificates for internal names come from AWS Private CA. Only clients that trust your CA accept them.

Cost

How you are charged, not what it costs today

Public certificates on integrated services: no charge. You pay for the load balancer or the distribution, not for the certificate.

Exportable public certificates are charged when issued and when renewed, differently for a single name and for a wildcard.

Private certificates are charged through AWS Private CA.

Prices change, so none are printed here. Check the ACM pricing page on aws.amazon.com.

Comparison

Four kinds of certificate
KindTrusted byRenewed by ACMChoose it when
Public, DNS validatedBrowsers and most clientsYes, while in use and the CNAME record staysAlmost always, for a public site
Public, email validatedBrowsers and most clientsOnly after the owner follows the renewal emailYou cannot edit the domain's DNS
ImportedWhoever trusts the CA that issued itNo: import a new one before it expiresThe certificate must come from another CA
Private, from AWS Private CAOnly clients that trust your CAYes, when requested through ACM and in use or exportedInternal names and services

SAA traps

The phrase in the question, and what it means
use an ACM certificate with CloudFrontRequest or import it in us-east-1

CloudFront reads certificates only from US East (N. Virginia), wherever its origins are.

the same domain on load balancers in two RegionsA certificate in each Region

Certificates are regional and cannot be copied. The same CNAME record validates both.

certificates must renew with nobody involvedDNS validation

ACM renews while the certificate is in use and the CNAME record is in place.

an imported certificate expired and took the site downACM does not renew imported certificates

You have to watch its expiry date and import a new one before it runs out.

one certificate for example.com and all its subdomainsexample.com plus *.example.com

A wildcard covers one level of subdomains and never the apex, so the apex is added as a second name.

several HTTPS domains on one load balancer listenerSeveral certificates, chosen by SNI

The listener picks the certificate that matches the host name the client asks for.

a trusted certificate for software on an EC2 instanceACME automation, or an exportable public certificate

The free certificates are for integrated services such as load balancers and CloudFront.

certificates for internal services that browsers need not trustPrivate certificates from AWS Private CA

Only clients that trust your private CA accept them.

Scenario

Exam style, marked when you answer

A company serves its website through CloudFront, with an Application Load Balancer origin in ap-south-1. A developer requested an ACM certificate for www.example.com in ap-south-1 and attached it to the load balancer, but it does not appear when they add the custom domain to the distribution. What should they do?

Practice

Fill the gap, the way the challenges work

A public website's Application Load Balancer needs a certificate for its HTTPS listener. The team wants it issued at no charge, validated through DNS, and renewed before it expires without anyone being reminded. Where does the certificate come from?

Pick a service belowALB· HTTPS listenerEC2· Web servers

Quick revision

The night before the exam
Public
Free on integrated services, and valid for 198 days.
Validation
DNS renews by itself. Email needs someone to follow the link.
Renewal
From 45 days before expiry, while in use and the CNAME record remains.
Regions
Regional, never copied; CloudFront needs us-east-1.
Wildcard
One level only; add the apex as a second name.
Imported
Never renewed by ACM.
Private
From AWS Private CA, trusted only by your own clients.
Your own servers
ACME automation, or an exportable certificate, which is charged.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.

Still there?

You have been away for a while. We have saved what you were working on in this browser. In 60 seconds you will be signed out to keep your account safe.