AWS Certificate Manager (ACM)

Introduction

AWS Certificate Manager (ACM) is Amazon's managed service for provisioning, managing, and deploying SSL/TLS certificates. It's powerful, free for public certificates, and deeply integrated with AWS services—but it comes with rules that trip up even experienced engineers.

ACM vs. the Alternatives

Decision Tree

Is it on AWS (CloudFront, ALB, API Gateway)?
├─ YES → ACM Public (free, auto-renew)
└─ NO
   ├─ EC2 instance? → ALB in front → ACM Public
   │                  OR → Let's Encrypt on EC2
   ├─ On-premises? → ACM Private CA ($$)
   │                 OR → Let's Encrypt
   │                 OR → Commercial CA
   └─ Need OV/EV? → Commercial CA only

The us-east-1 Rule

CloudFront (Global) vs Origin (Regional)

DNS vs Email Validation

DNS Validation Process

ACM generates a unique CNAME record for each domain. Add this to your DNS:

# Example CNAME record for DNS validation
Name:  _abc123def456ghi789.example.com
Type:  CNAME
Value: _xyz987wvu654.acm-validations.aws.

Why Your Certificate is Stuck on "Pending Validation"

Common Causes

1. 1

   CNAME not propagated yet

   DNS changes can take 5-60 minutes. Check propagation:

   bash

   dig _abc123def456.example.com CNAME +short

2. 2

   Wrong DNS zone

   If validating api.example.com, the CNAME must be in the example.com zone, not a subdomain zone.

3. 3

   Typo in CNAME name or value

   Copy-paste from ACM console. Don't type it manually.

4. 4

   CAA records blocking Amazon

   Check for restrictive CAA records:

   bash

   dig example.com CAA +short
   # Should include: 0 issue "amazon.com"
   # Or have no CAA records at all

Where ACM Certificates Work

Supported Services (Works)

Not Supported (Doesn't Work)

The EC2 Workaround

Auto-Renewal: When "Automatic" Isn't

ACM auto-renewal works differently for DNS vs Email validation:

When Renewal Silently Fails

• CNAME record was deleted (someone "cleaned up" DNS)
• Domain transferred to different registrar/DNS
• CAA records added that block Amazon
• Domain expired or WHOIS info changed
• Certificate not associated with any AWS resource

Set Up CloudWatch Alarms

# Alert when certificate expires in less than 30 days
aws cloudwatch put-metric-alarm \
  --alarm-name "ACM-CertExpiring-example-com" \
  --metric-name DaysToExpiry \
  --namespace AWS/CertificateManager \
  --statistic Minimum \
  --period 86400 \
  --threshold 30 \
  --comparison-operator LessThanThreshold \
  --dimensions Name=CertificateArn,Value=arn:aws:acm:... \
  --evaluation-periods 1 \
  --alarm-actions arn:aws:sns:...

ACM Private CA

ACM Private CA lets you run your own Certificate Authority for internal use. It's powerful but expensive.

Alternatives to ACM Private CA

Common CLI Tasks

Request a New Certificate

# Request certificate with DNS validation
aws acm request-certificate \
  --domain-name example.com \
  --subject-alternative-names "*.example.com" \
  --validation-method DNS \
  --region us-east-1  # For CloudFront!

List All Certificates

# List certificates in a region
aws acm list-certificates --region us-east-1

# With details (status, domains)
aws acm list-certificates \
  --region us-east-1 \
  --includes keyTypes=RSA_2048,EC_prime256v1

Check Certificate Status

# Get certificate details
aws acm describe-certificate \
  --certificate-arn arn:aws:acm:us-east-1:123456789:certificate/abc-123 \
  --region us-east-1

# Check validation status specifically
aws acm describe-certificate \
  --certificate-arn arn:aws:acm:... \
  --query 'Certificate.DomainValidationOptions[*].ValidationStatus'

Delete a Certificate

# Delete (must not be in use)
aws acm delete-certificate \
  --certificate-arn arn:aws:acm:us-east-1:123456789:certificate/abc-123 \
  --region us-east-1

Troubleshooting Quick Reference

Frequently Asked Questions

Related Resources

Summary