Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Issues, stores and renews the TLS certificates for your load balancers and CloudFront distributions. Public certificates for those services cost nothing.
Where ACM takes you5 steps, all open
ACM handles the SSL/TLS certificates that HTTPS needs: creating them, storing them with their keys, and renewing them. It can issue a public certificate that browsers trust, a private one signed by AWS Private CA for internal names, or take one you got elsewhere as an import.
It works through integrated services. You attach the certificate to a load balancer or a CloudFront distribution, and ACM renews the ones it issued before they expire. Public certificates for those services cost nothing extra.
To get a passport you prove who you are, and it expires after a set time. ACM checks that you control a domain, issues the certificate, and, as long as the proof is still on file and the certificate is in use, renews it before it expires without being asked.
Domain validationDNS validationPublic certificatePrivate certificateManaged renewalWildcardwww.example.com, a wildcard like *.example.com, or both the apex and the wildcard.Is it in the resource's Region? CloudFront reads certificates only from us-east-1.
Has ACM seen proof that you control every name on it?
Is it attached to an integrated service, such as a load balancer or a distribution?
45 days before expiry, ACM checks the certificate is in use and every CNAME record is still in DNS, then renews it.
Pick a case to follow the certificate through each check.
Certificates are regional, and cannot be copied between Regions. A name used in two Regions needs a certificate in each. With DNS validation, the same CNAME record validates both, because the token works in any Region.
One listener, several sites. A load balancer's HTTPS listener holds a default certificate and a list of others, and picks the one that matches the host name the client asks for.
Certificates for integrated services stay with those services. For a publicly trusted certificate on your own server, such as an EC2 instance, AWS points you to ACME automation, or to an exportable public certificate, which is charged.
Validate by DNS. A DNS-validated certificate renews by itself. Email validation depends on someone answering a renewal email in time, and a certificate cannot be switched from email to DNS validation later.
Key algorithms. ACM issues certificates with RSA 2048-bit or ECDSA 256-bit and 384-bit keys. ECDSA keys are smaller for the same strength, but not every client supports them.
Private certificates for internal names come from AWS Private CA. Only clients that trust your CA accept them.
Public certificates on integrated services: no charge. You pay for the load balancer or the distribution, not for the certificate.
Exportable public certificates are charged when issued and when renewed, differently for a single name and for a wildcard.
Private certificates are charged through AWS Private CA.
Prices change, so none are printed here. Check the ACM pricing page on aws.amazon.com.
| Kind | Trusted by | Renewed by ACM | Choose it when |
|---|---|---|---|
| Public, DNS validated | Browsers and most clients | Yes, while in use and the CNAME record stays | Almost always, for a public site |
| Public, email validated | Browsers and most clients | Only after the owner follows the renewal email | You cannot edit the domain's DNS |
| Imported | Whoever trusts the CA that issued it | No: import a new one before it expires | The certificate must come from another CA |
| Private, from AWS Private CA | Only clients that trust your CA | Yes, when requested through ACM and in use or exported | Internal names and services |
use an ACM certificate with CloudFrontRequest or import it in us-east-1
CloudFront reads certificates only from US East (N. Virginia), wherever its origins are.
the same domain on load balancers in two RegionsA certificate in each Region
Certificates are regional and cannot be copied. The same CNAME record validates both.
certificates must renew with nobody involvedDNS validation
ACM renews while the certificate is in use and the CNAME record is in place.
an imported certificate expired and took the site downACM does not renew imported certificates
You have to watch its expiry date and import a new one before it runs out.
one certificate for example.com and all its subdomains
example.com plus *.example.comA wildcard covers one level of subdomains and never the apex, so the apex is added as a second name.
several HTTPS domains on one load balancer listenerSeveral certificates, chosen by SNI
The listener picks the certificate that matches the host name the client asks for.
a trusted certificate for software on an EC2 instanceACME automation, or an exportable public certificate
The free certificates are for integrated services such as load balancers and CloudFront.
certificates for internal services that browsers need not trustPrivate certificates from AWS Private CA
Only clients that trust your private CA accept them.
A company serves its website through CloudFront, with an Application Load Balancer origin in ap-south-1. A developer requested an ACM certificate for www.example.com in ap-south-1 and attached it to the load balancer, but it does not appear when they add the custom domain to the distribution. What should they do?
A public website's Application Load Balancer needs a certificate for its HTTPS listener. The team wants it issued at no charge, validated through DNS, and renewed before it expires without anyone being reminded. Where does the certificate come from?
198 days.45 days before expiry, while in use and the CNAME record remains.us-east-1.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.