Automate public TLS certificate issuance with ACME support in AWS Certificate Manager | Amazon Web Services (opens in new tab)
AWS Certificate Manager (ACM) now supports public TLS certificate issuance through ACMEv2, enabling automation with clients such as Certbot, cert-manager, and acme.sh. This addresses increasingly short certificate lifetimes—100 days from 2027 and 47 days by 2029—while centralizing certificate governance and visibility in AWS. The service combines Amazon Trust Services certificates with IAM, domain scopes, CloudTrail, CloudWatch, and ACM expiry notifications. ## Why ACME Automation Matters - Manual certificate renewal risks outages and browser errors. - ACME is an open protocol used by Let’s Encrypt and many certificate clients. - ACM’s managed ACME endpoint allows organizations to continue using standard ACME tooling without relying on separate certificate authorities. - Certificates issued through ACME appear alongside other ACM certificates in centralized searches and dashboards. ## Centralized Governance and Monitoring - PKI administrators can create one or more managed ACME endpoints. - IAM roles can be associated with ACME accounts to control which domains clients may request. - Endpoint-level domain scopes restrict requests to: - Exact domains - Subdomains - Wildcard certificates - AWS CloudTrail records certificate requests for auditing. - Amazon CloudWatch provides operational metrics. - ACM sends notifications as certificates approach expiration. - Centralized controls reduce the need for separate lifecycle-management products or custom policy systems. ## Endpoint and Domain Configuration - Administrators create a public ACME endpoint in ACM. - Certificates are issued by Amazon Trust Services and are trusted by standard browsers and operating systems. - Supported key types include: - ECDSA P-256 by default - RSA 2048 - ECDSA P-384 - Domains are validated once at the endpoint level using DNS validation. - Route 53 hosted zones can be updated automatically; other DNS providers require manual creation of the supplied CNAME record. - Application owners do not need access to DNS credentials. ## External Account Binding - Clients register with the ACME server using External Account Binding (EAB). - EAB consists of: - A key identifier - An HMAC key - After registration, the ACME client creates its own asymmetric key pair for subsequent authentication. - EAB credentials can be named and given expiration dates, limiting their lifetime and exposure. ## Using Existing ACME Clients - ACM provides command examples for Certbot and acme.sh. - A Certbot request uses: - The ACM ACME directory URL - EAB key ID and HMAC key - An issuance timeout - The requested domain - Clients can run in containers such as `certbot/certbot`. - The same endpoint can support existing ACME-compatible automation workflows. ACM’s ACME support is best suited to organizations that want automated public certificate issuance without sacrificing centralized policy, auditing, and monitoring. Administrators should validate domains centrally, limit wildcard access where possible, use short-lived EAB credentials, and integrate the endpoint with their existing ACME client automation.