AWS Certificate Manager (ACM)

Overview

AWS Certificate Manager (ACM) is a service that lets you easily provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services and your internal connected resources. ACM removes the time-consuming manual process of purchasing, uploading, and renewing SSL/TLS certificates.

Understanding ACM is essential for the SAA-C03 exam because secure communication is a fundamental requirement. You must know the differences between public and private certificates, certificate validation methods, which services integrate with ACM, and the regional requirements for different services.

Key Concepts

Certificate Types

Certificate Validation Methods

Before issuing a public certificate, ACM must verify you own or control the domain:

DNS VALIDATION (Recommended):
├── Add CNAME record to DNS
├── Record format: _xxx.domain.com → _xxx.acm-validations.aws
├── Automatic renewal works
├── One-time setup
└── Best for: Production, automated environments

EMAIL VALIDATION:
├── Emails sent to domain contacts
├── admin@domain.com, hostmaster@domain.com, etc.
├── Requires manual response for renewal
├── Cannot be automated
└── Best for: Legacy, one-time certificates

ACM Certificate Contents

Domain Names:
├── Primary domain: example.com
├── Subject Alternative Names (SANs):
│   ├── www.example.com
│   ├── api.example.com
│   └── *.example.com (wildcard)
└── Maximum: 10 domain names per certificate

Certificate Details:
├── Serial Number: Unique identifier
├── Validity: Not Before / Not After dates
├── Signature Algorithm: SHA-256 with RSA
├── Public Key: RSA 2048-bit
├── Key Usage: Digital Signature, Key Encipherment
└── Extended Key Usage: TLS Web Server Authentication

Wildcard Certificates

Certificate: *.example.com

COVERS:
├── www.example.com      ✓
├── api.example.com      ✓
├── app.example.com      ✓
└── any.example.com      ✓

DOES NOT COVER:
├── example.com          ✗ (apex domain)
├── sub.api.example.com  ✗ (two levels deep)
└── sub.www.example.com  ✗ (two levels deep)

Solution for apex + wildcard:
Request certificate with both:
├── example.com
└── *.example.com

How It Works

Certificate Lifecycle

1. PENDING_VALIDATION
   └── Waiting for DNS/email validation

2. ISSUED
   └── Certificate is active and ready to use

3. INACTIVE
   └── Imported certificate not attached to any resource

4. EXPIRED
   └── Certificate validity period ended

5. REVOKED
   └── Certificate was revoked (cannot be undone)

6. FAILED
   └── Validation failed or other error

Renewal Timeline:
├── 60 days before expiry: ACM attempts renewal
├── Renewal requires: DNS validation record still present
├── 45 days: Email notification if renewal failing
├── 30 days: Urgent notification
└── Expiry: Certificate stops working

ACM Integration Architecture

Integrated Services:

Regional Considerations

CLOUDFRONT (GLOBAL):
└── Certificates MUST be in us-east-1
    Why: CloudFront is a global service; uses N. Virginia for control plane

REGIONAL SERVICES (ALB, API Gateway, etc.):
└── Certificates MUST be in SAME region as the service

MULTI-REGION DEPLOYMENT:
Example: ALB in us-east-1 and eu-west-1
├── Request cert in us-east-1 for us-east-1 ALB
└── Request separate cert in eu-west-1 for eu-west-1 ALB
    (Same domain, different regional certificates)

CLOUDFRONT + ALB BEHIND:
├── CloudFront cert: us-east-1
└── ALB cert: Whatever region ALB is in (origin)

AWS Private CA

AWS Private Certificate Authority is for issuing private certificates for internal resources:

When to Use Private CA

*ACM cannot export certificates for EC2; use Private CA or import certificates.

Private CA Hierarchy

Recommended Structure:

Root CA (offline when not signing)
    └── Validity: 10-20 years
    └── Usage: Sign subordinate CAs only

    ├── Subordinate CA (Production)
    │   └── Validity: 3-5 years
    │   └── Signs end-entity certificates
    │
    └── Subordinate CA (Development)
        └── Validity: 1-3 years
        └── Signs dev/test certificates

End-Entity Certificates:
└── Validity: 1 year or less
└── Issued to servers, clients, devices

Private CA Modes

Use Cases

Use Case 1: Public Website with Custom Domain

Scenario: Deploy a public website with HTTPS on a custom domain.

Solution:

1. Request public certificate for example.com and www.example.com
2. Use DNS validation (add CNAME record)
3. Attach to CloudFront distribution or ALB
4. Configure HTTP to HTTPS redirect
5. Cost: FREE (ACM public certificates)

Use Case 2: Multi-Region API Gateway

Scenario: REST API deployed in multiple regions with custom domain.

Solution:

1. Request certificate in each region:
   • api.example.com in us-east-1
   • api.example.com in eu-west-1
2. Use DNS validation (same CNAME works for all)
3. Attach to regional API Gateway custom domains
4. Use Route 53 latency routing for regional endpoints

Use Case 3: Internal Microservices with mTLS

Scenario: Microservices require mutual TLS authentication.

Solution:

1. Deploy AWS Private CA
2. Issue server and client certificates
3. Configure services to require client certificates
4. Implement certificate rotation via ACM

# Request private certificate from Private CA
aws acm-pca issue-certificate \
  --certificate-authority-arn arn:aws:acm-pca:region:account:certificate-authority/xxx \
  --csr fileb://csr.pem \
  --signing-algorithm SHA256WITHRSA \
  --validity Value=365,Type=DAYS

Use Case 4: TLS on EC2 Instances

Scenario: EC2 instances need TLS certificates (not behind load balancer).

Solution:

• Option A: AWS Private CA

  • Issue private certificates
  • Export and install on EC2
  • Automate rotation with SSM

• Option B: Import third-party certificate

  • Purchase from CA (DigiCert, Let's Encrypt, etc.)
  • Import into ACM for management
  • Re-import when renewed

Note: ACM public certificates cannot be exported or used directly on EC2.

Best Practices

Certificate Management

1. Always use DNS validation

   • Enables automatic renewal
   • Keep CNAME records permanently
   • Works across multiple certificates

2. Request certificates in correct region

   • CloudFront: us-east-1
   • Regional services: same region
   • Plan before deployment

3. Use wildcards appropriately

   • Consider security implications
   • Include apex domain explicitly
   • *.example.com + example.com

4. Monitor certificate expiration

   • CloudWatch alarms for ACM events
   • AWS Config rule: acm-certificate-expiration-check
   • Set up notifications at 45 days

Security Best Practices

1. Minimum TLS version

   • Configure TLS 1.2 minimum on services
   • Use TLS 1.3 where supported
   • Avoid deprecated cipher suites

2. HTTPS everywhere

   • Redirect HTTP to HTTPS
   • Enable HSTS headers
   • Use preload lists for critical domains

3. Private CA security

   • Protect root CA (offline when possible)
   • Use separate CAs per environment
   • Short validity for end-entity certs

4. Certificate transparency

   • Public certificates are logged to CT logs
   • Monitor for unauthorized certificates
   • AWS publishes to CT by default

Operational Best Practices

1. Automate certificate provisioning

   • Use CloudFormation/CDK for ACM resources
   • Automate DNS validation records
   • Infrastructure as code

2. Test certificate renewal

   • Verify DNS records are in place
   • Test before 60-day renewal window
   • Document recovery procedures

3. Plan for certificate replacement

   • Use key aliases and abstractions
   • Document all certificate dependencies
   • Test rotation in non-production

Common Exam Scenarios

Common Pitfalls

Related Services

Quick Reference

ACM Limits

ACM Pricing

Certificate Validity

CLI Commands

# Request public certificate
aws acm request-certificate \
  --domain-name example.com \
  --subject-alternative-names www.example.com \
  --validation-method DNS \
  --region us-east-1

# List certificates
aws acm list-certificates \
  --certificate-statuses ISSUED

# Get certificate details
aws acm describe-certificate \
  --certificate-arn arn:aws:acm:region:account:certificate/xxx

# Get DNS validation records
aws acm describe-certificate \
  --certificate-arn arn:aws:acm:region:account:certificate/xxx \
  --query "Certificate.DomainValidationOptions"

# Import certificate
aws acm import-certificate \
  --certificate fileb://cert.pem \
  --private-key fileb://key.pem \
  --certificate-chain fileb://chain.pem

Test Your Knowledge

Further Reading

• AWS Certificate Manager User Guide
• DNS Validation
• ACM Certificate Characteristics
• AWS Private CA User Guide
• Using ACM with CloudFront
• ACM Managed Renewal