TLS Certificates with AWS Certificate Manager

Encryption in transit protects data as it moves across networks using TLS (Transport Layer Security), the protocol behind HTTPS.

Without it, attackers on the path could read or tamper with traffic. TLS requires certificates, and managing those is where ACM comes in.

AWS Certificate Manager (ACM) provisions, manages, and renews TLS certificates for AWS services.

• Public certificates from ACM are free.
• ACM handles renewal automatically, removing the risk of expired certificates.

To issue a public certificate, ACM must verify you control the domain.

• DNS validation adds a CNAME record (preferred, enables auto-renewal).
• Email validation sends a confirmation to domain contacts.

DNS validation is recommended for hands-off renewal.

ACM integrates with AWS services that terminate TLS, including:

• Application and Network Load Balancers.
• CloudFront distributions.
• API Gateway.

You attach the certificate to the listener; the service handles the TLS handshake.

For ACM-issued certificates used by integrated services, the private key is managed by ACM and never exposed.

You cannot download it, which is a security benefit: there is no key file to leak. The certificate simply works with the supported service.

ACM renews managed certificates automatically before they expire, as long as validation remains in place (DNS records present).

This eliminates outages caused by forgotten certificate renewals, a classic operational failure. Email-validated certs may need manual steps.

AWS Private CA (Certificate Authority) issues private certificates for internal use.

Use it for service-to-service mTLS, internal APIs, and devices that should trust your own CA rather than a public one. It is a paid service for internal PKI needs.

You can import third-party certificates into ACM for use with integrated services.

However, imported certificates are not auto-renewed; you must re-import before expiry. Native ACM-issued certs are preferable when possible for the renewal automation.

ACM has region nuances worth remembering:

• Certificates for CloudFront must be requested in us-east-1.
• Certificates for regional resources (ALB) live in that resource's region.

This region rule is a common exam detail.

When attaching a certificate to a load balancer or CloudFront, you also pick a security policy that defines allowed TLS versions and ciphers.

Modern policies require TLS 1.2 or higher and drop weak ciphers. Choosing a strong policy prevents clients from negotiating outdated, vulnerable encryption even when a valid certificate is present.

Beyond providing certificates, enforce that traffic uses TLS.

• Redirect HTTP to HTTPS on load balancers and CloudFront.
• Use bucket policies (aws:SecureTransport) to deny non-TLS S3 access.

Issuing a certificate is not enough; usage must be required.

Recall an ACM detail.

You learned about ACM and TLS.

• ACM provisions and auto-renews free public TLS certificates.
• Attach them to ALB, CloudFront, and API Gateway; the private key stays protected.
• CloudFront certs must be in us-east-1, and you must still enforce TLS usage.