AWS Certificate Manager adds ACME support for automated public TLS certificate issuance

If you manage TLS certificates for your applications, you know the challenge: certificates expire, and when they do, your customers see errors or your service goes down. As certificate validity periods get shorter (the Certification Authority (CA)/Browser Forum mandates reduced maximum validity to 100 days starting March 2027, and to 47 days by 2029), manual renewal processes become untenable. You need automation. Automatic Certificate Management Environment (ACME) is an open protocol for requesting, renewing, and revoking TLS certificates without human intervention. It’s the same protocol behind Let’s Encrypt, and it’s supported by dozens of clients across every platform. Today we’re announcing ACME support for public certificates in AWS Certificate Manager (ACM). ACM now provides a fully managed ACME server endpoint that works with any ACMEv2-compatible client, such as Certbot, cert-manager for Kubernetes, acme.sh, or any other client you already use. You can issue public TLS certificates from Amazon Trust Services through the standard ACME protocol. Before today, if you wanted automated certificate management using the ACME protocol, you relied on external certificate authorities alongside ACM, leading to a fragmented visibility experience. Some certificates lived in ACM, others were managed externally with no central dashboard. PKI administrators had limited ability to control who could request certificates or which domains were allowed. With ACME support in ACM, you can now set up one or more managed ACME endpoints that allow you to centrally manage and monitor ACME certificate usage across your organization. As a PKI administrator, you get centralized controls that go beyond basic certificate issuance. You can bind IAM roles to ACME accounts for fine-grained access control over which domains each client can request. You can define domain scopes at the endpoint level to enforce organization-wide policies. And you get centralized monitoring and visibility in the same place: AWS CloudTrail logs every certificate request for auditability, Amazon CloudWatch tracks operational metrics, and ACM sends expiry notifications when certificates are approaching renewal. Using ACM, your PKI team can search all certificates, whether issued through the ACM console, an API call, or ACME. To get started, you first set up a dedicated ACME endpoint, configure authorization controls using External Account Binding (EAB), validate which domains the endpoint can issue certificates for, and point your existing ACME clients to the new endpoint. The domain validation step is important: it separates who can set up certificate issuance from who can request certificates. The PKI administrator validates domains once at the endpoint level, using DNS credentials that stay with the admin. Application owners who need certificates never touch DNS. They register with an EAB credential, and the endpoint enforces which domains and scopes they’re allowed to request. This means you can distribute certificate automation broadly across your organization without distributing DNS keys along with it. The article walks through creating an ACME endpoint in the ACM console, choosing public endpoint and certificate types, configuring domain scopes (exact domain, subdomains, wildcards), and selecting Route 53 hosted zones for automatic DNS validation. ACM automatically creates DNS CNAME records needed for domain validation, or manual creation is required if hosted outside Route 53. Centralized controls allow PKI administrators to authenticate domains, restrict certificate types (ECDSA or RSA), and limit wildcard issuance, reducing the need for separate lifecycle management products. After endpoint creation, the domain validation completes via DNS validation. Then, External Account Binding (EAB) credentials are created to allow ACME clients to register accounts with the ACM ACME server. The article shows how to obtain the Key ID and HMAC key for client configuration. Finally, the article demonstrates requesting a certificate using Certbot with the ACM ACME endpoint and EAB credentials, resulting in a valid certificate signed by Amazon Trust Services. The certificate is visible in the ACM console alongside others issued via the console or API. ACME support in ACM is available in all commercial AWS Regions with plans for GovCloud, China, and European Sovereign Cloud regions. Pricing is per domain included in each certificate, with volume tiers based on total domain occurrences per month. To get started, users can visit the ACM section on the AWS console or read the documentation.