AWS Certificate Manager
Provisions, manages, and auto-renews SSL/TLS certificates for AWS services.
Verified against AWS documentation · 2026-08-27
Key facts
- 01Public certificates for ACM-integrated services (ALB, CloudFront, API Gateway) are free — you never touch the private key
- 02DNS validation → auto-renewal forever; email validation → someone must click a link before expiry, or the cert lapses
- 03Regional service: the cert must live in the same Region as the resource using it — except CloudFront, which only reads certs from us-east-1
- 04Limits: 2,500 certs per Region per account, 10 domain names per cert (raisable to 100), wildcard covers one subdomain level only (*.example.com, not a.b.example.com)
Exam triggers
Phrases and scenarios that point here.
- "HTTPS on the load balancer / CloudFront / API Gateway" → ACM public cert, free
- "Certificate expired and the site went down" → email validation was used; switch to DNS validation for auto-renewal
- "Custom domain on CloudFront" → cert must be requested in us-east-1, regardless of where anything else lives
- "TLS on an EC2 instance directly" → exam convention: ACM public certs can't be exported, so use a third-party cert or Private CA. Reality since June 2025: exportable public certs exist, but they're paid — expect the exam to lag here
Not this service
- Certificates for internal-only apps and devices with your own CA hierarchy → AWS Private CA
- Storing arbitrary secrets, API keys, or database credentials → Secrets Manager
Use cases
- 01Terminating HTTPS at an ALB fronting a fleet of instances — traffic is encrypted to the edge, plain HTTP inside the VPC, and nobody ever files a renewal ticket again
- 02One wildcard cert (*.shop.example) covering every tenant subdomain of a SaaS storefront, attached to a single ALB listener
- 03CloudFront distribution with a custom domain — the one architecture where the us-east-1 rule bites teams deploying everything in ap-southeast-1
- 04Killing the annual 2 a.m. outage caused by a certificate someone bought manually three years ago and forgot about — DNS-validated ACM certs renew themselves
How it's charged
- 01Non-exportable public certificates: no charge, ever — issuance, renewal, and use with integrated services are all free
- 02Exportable public certificates (June 2025 feature) are charged per domain name at issuance AND at every renewal — and with 198-day validity, renewals now come roughly twice a year
- 03Wildcard names on exportable certs are billed at a much higher rate than standard FQDNs — the classic billing surprise is ticking the 'export' box without realizing it converts a free cert into a recurring charge
- 04Private certificates are billed through AWS Private CA (monthly CA fee + per-cert issuance), not through ACM
- 05Imported third-party certs are free to store, but ACM won't renew them — that's still your job
