Skip to main content
This lesson explains AWS Certificate Manager (ACM): what digital certificates are, why they matter, how ACM works, and practical deployment guidance for AWS services. What is a certificate? A certificate is a digital document that proves the identity of a website, server, application, or individual. It typically contains the entity name, a public key, expiration information, and a digital signature from a Certificate Authority (CA). Certificates are the foundation for establishing trust and enabling secure TLS/SSL communications.
A slide titled "Digital Certificates" showing a user icon on the left connected by a line labeled "Secured connection" (with a certificate icon) to a web/app icon inside a dotted box on the right. The diagram illustrates using a digital certificate to secure communication between the user and the application.
Key purposes of certificates:
  • Authentication — verify the identity of the server or service so clients know they are talking to the intended party.
  • Encryption — enable TLS/SSL to encrypt data in transit between client and server.
  • Integrity — ensure the data has not been tampered with in transit.
  • Trust — certificates are issued by trusted certificate authorities after verification.
  • Compliance — many regulatory standards require SSL/TLS protection for sensitive data.
A slide titled "Why do we need Certificate?" listing five reasons—01 Authentication, 02 Data Encryption, 03 Data Integrity, 04 Trust, and 05 Compliance and Regulation—each shown with a colored circular icon.
What is AWS Certificate Manager (ACM)? ACM is a managed AWS service that helps you request, provision, and manage SSL/TLS certificates for AWS-integrated endpoints. Use ACM to obtain public certificates for internet-facing services or pair it with AWS Private Certificate Authority (PCA) to issue private certificates for internal systems. Primary components
  • AWS Certificate Manager (ACM): requests, validates, issues, and manages certificates for supported AWS services.
  • AWS Private Certificate Authority (PCA): a managed private CA for internal/private certificates (PCA is a paid feature).
Common services that receive certificates from ACM:
  • Elastic Load Balancing (ALB/NLB)
  • Amazon CloudFront
  • Amazon API Gateway
A diagram titled "Certificate Manager" showing AWS Private Certificate Authority and public certificates feeding into AWS Certificate Manager (ACM), which then distributes certificates to Elastic Load Balancer, Amazon CloudFront, and Amazon API Gateway. Icons and arrows illustrate the issuance and distribution of TLS/SSL certificates.
ACM-issued public certificates are provided at no additional cost. The private key for certificates issued by ACM is managed by AWS and is not exportable. If you need an exportable certificate (for example, to install directly on an on-prem server), you must import your own certificate with its private key into ACM.
How ACM works — high-level process
  1. Request or import a certificate — specify the domain names the certificate must cover, e.g., example.com and www.example.com.
  2. Domain ownership validation — validate domain control with DNS validation (recommended and automatable using Amazon Route 53) or email validation.
  3. Certificate issuance — ACM issues the certificate after successful validation.
  4. Certificate management — ACM auto-renews issued certificates; retain validation records (DNS) to allow automatic renewal.
A teal-gradient presentation slide titled "How does ACM work?" with four numbered steps on the right: 01 Requesting a certificate, 02 Domain ownership verification, 03 Certificate issuance, and 04 Certificate management. The layout has a large left panel with the title and a white right side with rounded-step boxes.
Practical deployment points and best practices
  • Attach certificates to HTTPS/TLS listeners on fronting services:
    • Application Load Balancer (ALB) — use for HTTP(S) and path-based routing.
    • Network Load Balancer (NLB) — use TLS listeners for high-performance, low-latency TCP-based TLS termination.
    • CloudFront — use for global CDN-distributed HTTPS termination (public certificates for CloudFront must be in us-east-1).
    • API Gateway — use for TLS termination on APIs.
  • Backend communication: between the load balancer and backend instances you can choose HTTP or HTTPS. Use end-to-end encryption (HTTPS) for stronger security and compliance.
  • Regional scope: ACM is regional. Certificates are created in a specific AWS Region and cannot be used across Regions. Exception: public ACM certificates for CloudFront must be created in us-east-1 (N. Virginia).
Because ACM is regional, request certificates in the region where the fronting service resides. For CloudFront distributions, request the certificate in us-east-1. Also, automatic renewal requires the DNS validation records to remain present (if using DNS validation).
Supported vs unsupported usage (quick reference) Features and benefits
A "Features" slide showing five numbered panels with colored circular icons. The panels list: Automated Certificate Provisioning, Auto‑Renewal, Seamless Deployment, Central Management, and AWS Integration.
  • Automated provisioning for public certificates and private certificates (with PCA).
  • Auto-renewal for ACM-managed certificates (provided validation remains in place).
  • Seamless deployment to supported AWS services, reducing manual configuration errors.
  • Centralized certificate management across IAM and AWS-integrated services.
  • Tight AWS integration: ELB, CloudFront, API Gateway, and more.
Summary — typical lifecycle
  1. Request a certificate (or import an existing one).
  2. Validate domain ownership (DNS or email).
  3. ACM issues the certificate.
  4. Attach the certificate to a supported service (ALB, NLB, CloudFront, API Gateway).
  5. ACM auto-renews certificates it manages (ensure validation records remain valid to enable automatic renewal).
Useful links and references ACM gives you a managed, integrated way to handle TLS certificates so you can focus on delivering secure applications instead of certificate plumbing.

Watch Video