AWS Certificate Manager (ACM)
AWS Certificate Manager (ACM) is an Amazon Web Services service that lets you provision, manage, and deploy public and private SSL/TLS X.509 certificates for use with AWS services and your internal connected resources. It secures consumer web apps by using SSL/TLS to encrypt traffic in transit.
Key points
- HTTPS transactions require server certificates (X.509) that bind the public key in the certificate to provide authenticity; certificates are signed by a certificate authority (CA) and contain the server’s name, validity period, public key, and signature algorithm.
- Centrally manages the certificate lifecycle and automates certificate renewals.
- SSL/TLS certificates provide data-in-transit security and authenticate the identity of sites and the connections between browsers and applications.
- Six SSL certificate types:
- Extended Validation Certificates (EV SSL) — the most expensive SSL certificate type.
- Organization Validated Certificates (OV SSL) — validates a business’s credibility.
- Domain Validated Certificates (DV SSL) — provides minimal encryption.
- Wildcard SSL Certificate — secures a base domain and its subdomains.
- Multi-Domain SSL Certificate (MDC) — secures up to hundreds of domains and subdomains.
- Unified Communications Certificate (UCC) — a single certificate that secures multiple domain names.
- Two ways to deploy managed X.509 certificates:
- AWS Certificate Manager (ACM) — for customers who need a secure, public web presence; certificates can be attached to integrated services such as Amazon CloudFront, Elastic Load Balancing, and Amazon API Gateway.
- ACM Private CA — for customers whose certificates are intended for private use within an organization.
- By default a publicly-trusted ACM certificate’s private key cannot be exported. As of June 17, 2025, you can request a public certificate as exportable and then export the certificate, chain, and encrypted private key for use on EC2 instances, containers, on-premises servers, or other clouds — but only for certificates requested as exportable after that date; existing certificates cannot be retroactively exported. Exportable certificates are valid for 395 days and carry a per-certificate charge (149 per wildcard name, paid once for the certificate’s lifetime), unlike standard ACM certificates for integrated services. To install a certificate on resources outside ACM-integrated services without using this feature, you can instead import your own third-party certificate into ACM.
- ACM manages TLS/SSL certificates only — it does not manage encryption keys; use AWS Key Management Service (KMS) or AWS CloudHSM (dedicated single-tenant HSM) for encryption key management.
Pricing
- Certificates created by ACM for ACM-integrated services are free.
- Exportable public certificates are billed per certificate (149 per wildcard name), a one-time charge for the certificate’s lifetime.
- AWS Certificate Manager Private Certificate Authority: monthly charges apply for the private CA operation and for the private certificates issued.