AWS Certificate Manager
Free HTTPS certificates
Issues and automatically renews SSL/TLS certificates for CloudFront, ALB, API Gateway.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?No
- Managed by AWS
- In examsCLF · SAA · SOA
Think of it asLike an agency that certifies a website's identity and renews it automatically when it expires.
Where does ACM fit?
ACM
A real example, step by step
- Your shop's website runs on plain HTTP and browsers flag it as “Not secure”.
- You request a public certificate for the domain in ACM and choose DNS validation.
- ACM gives you a CNAME record; you add it to Route 53 with one click and the certificate is issued within minutes, free of charge.
- You attach the certificate to an Application Load Balancer (or to CloudFront, in which case it must be created in us-east-1).
- Every year ACM renews the certificate automatically, so a forgotten renewal never takes the site down again.
When to use it
✓ Use it when
Enabling HTTPS for domains on AWS.
✗ Avoid it when
You need an internal CA for your own servers → Private CA.
Common uses
- HTTPS for CloudFront, ALB, API Gateway
- Auto-renewing certificates, no expiry worries
- Wildcard certificates *.example.com
ACM, KMS or CloudFront?
| ACM |  KMS |  CloudFront | |
|---|---|---|---|
| Manages | SSL/TLS certificates | Data encryption keys | Nothing; it just uses certificates |
| Encrypts | Data in transit (HTTPS) | Data at rest | Uses an ACM certificate to enable HTTPS |
| Renewal/rotation | Automatic renewal (DNS validation) | Automatic key rotation | Not applicable |
| Cost | Public certificates are free | Per key + calls | Per data transferred |
What does it cost?
- Pricing model: Public certificates attached to integrated AWS services: free. Exportable certificates and Private CA: charged.
- Free tier: Free for public certificates attached to AWS services.
Accidentally enabling Private CA (~$400/month per CA in general-purpose mode).
Certificates for CloudFront must be in us-east-1; for an ALB, in the ALB's region. Servers overloaded by SSL work → offload decryption to an ALB using an ACM certificate. Public ACM certificates can't be installed directly on EC2.
Try real exam questions
1A company has a dynamic web application hosted on two Amazon EC2 instances. The company has its own SSL certificate, which is on each instance to perform SSL termination. There has been an increase in traffic recently, and the operations team determined that SSL encryption and decryption is causing the compute capacity of the web servers to reach their maximum limit. What should a solutions architect do to increase the application's performance?
- ACreate a new SSL certificate using AWS Certificate Manager (ACM). Install the ACM certificate on each instance.
- BCreate an Amazon S3 bucket. Migrate the SSL certificate to the S3 bucket. Configure the EC2 instances to reference the bucket for SSL termination.
- CCreate another EC2 instance as a proxy server. Migrate the SSL certificate to the new instance and configure it to direct connections to the existing EC2 instances.
- DImport the SSL certificate into AWS Certificate Manager (ACM). Create an Application Load Balancer with an HTTPS listener that uses the SSL certificate from ACM.
Show answer
Correct answer: D
Import the certificate into ACM and put an Application Load Balancer with an HTTPS listener in front: the ALB does the encryption and decryption, freeing the EC2 instances' CPU. ACM certificates can't be installed on EC2.
2A company wants to configure its Amazon CloudFront distribution to use SSL/TLS certificates. The company does not want to use the default domain name for the distribution. Instead, the company wants to use a different domain name for the distribution. Which solution will deploy the certificate without incurring any additional costs?
- ARequest an Amazon issued private certificate from AWS Certificate Manager (ACM) in the us-east-1 Region.
- BRequest an Amazon issued private certificate from AWS Certificate Manager (ACM) in the us-west-1 Region.
- CRequest an Amazon issued public certificate from AWS Certificate Manager (ACM) in the us-east-1 Region.
- DRequest an Amazon issued public certificate from AWS Certificate Manager (ACM) in the us-west-1 Region.
Show answer
Correct answer: C
Public ACM certificates are free, and CloudFront only reads certificates from the us-east-1 region. Private certificates (Private CA) are charged.
Frequently asked questions
Are ACM SSL/TLS certificates free?
Public certificates used with integrated services such as ALB, CloudFront or API Gateway are free and renew automatically. Exportable public certificates that you install elsewhere are charged, and so are private certificates from AWS Private CA.
Why must certificates for CloudFront be created in us-east-1?
CloudFront is a global service and only reads ACM certificates from the US East (N. Virginia) region. For regional resources such as an ALB or API Gateway, the certificate must be in the same region as the resource.
Is DNS or email validation better?
Use DNS: add one CNAME record (one click with Route 53), and ACM then renews automatically with no action needed. Email validation requires confirming again at every renewal.
What do AWS exams ask about ACM?
Attaching a certificate to an ALB or CloudFront to enable HTTPS, the us-east-1 requirement for CloudFront, automatic renewal with DNS validation, and the fact that ACM certificates can't be installed directly on EC2 unless they are exportable.