Certablo
Sign inCreate account
← Knowledge Base
Security & Identityservice

AWS Certificate Manager & TLS Certificates

Managed X.509 certificate lifecycle for HTTPS and TLS: public versus private certificates, domain validation, regional placement, renewal and the distinction between certificate management and web-request filtering.

CLF-C02SAA-C03

Visual overview

DEFENSE IN DEPTHIdentity, data, network, detection, and audit controls protect different boundaries
IDENTITYAuthenticate + authorizePrincipals · policies · temporary credentials
DATAEncrypt + protect secretsKeys · certificates · application secrets
DETECT & AUDITFind threats + retain evidenceFindings · API history · configuration state
No single security service replaces the others. Strong AWS security combines preventive, detective, and evidence-producing controls around the workload.
AWS SERVICE MAPWeb edge security responsibilities

These services protect different layers: ACM supplies TLS identity, WAF evaluates web requests, and Shield focuses on DDoS protection.

ACMTLS certificate lifecycle
AWS WAFHTTP/S request filtering
AWS ShieldDDoS protection
EXAM-RELEVANT MECHANICS

Technical reference

Certificate troubleshooting is mostly about matching trust, name, validation method, Region, and TLS termination point.

Certificate formatX.509

ACM manages X.509 certificates that bind public keys to named identities/domains through a CA trust chain.

Recommended validationDNS CNAME

ACM provides a CNAME token; leaving the correct record in DNS enables continued validation for eligible managed renewal.

Public-key algorithmsRSA / ECDSA choices

Certificate requests expose supported key algorithm choices; the TLS endpoint and clients must support the selected certificate algorithm.

Regional scopeRegional resource

Certificates are requested/imported in the Region of most integrated endpoints rather than copied transparently between Regions.

CloudFront placementus-east-1

An ACM certificate associated with CloudFront must be requested or imported in US East (N. Virginia).

ACM manages the certificate lifecycle for TLS endpoints

AWS Certificate Manager (ACM) provisions, stores, and renews public and private X.509 certificates used to protect TLS connections. A certificate binds a public key to one or more domain names or identities through a certificate authority. For internet HTTPS, clients validate the certificate chain and hostname before using the negotiated TLS session to protect data in transit. ACM removes much of the manual certificate issuance and renewal work for integrated AWS services.

ACM can issue publicly trusted certificates, integrate with AWS Private CA for private PKI use cases, and import externally issued certificates. These choices solve different trust problems. A public website needs clients to trust a public CA chain, while an internal service may deliberately use a private CA whose root is distributed only to the organization's devices and workloads.

Domain validation proves control before public issuance

Before ACM issues a public certificate, domain ownership or control must be validated. DNS validation creates a CNAME record containing a validation token. Keeping the validation record in DNS allows ACM to verify control again for managed renewal, which is why AWS recommends DNS validation in common automated deployments. Email and supported HTTP validation have different lifecycle requirements and should not be assumed to behave like persistent DNS validation.

Certificate names also matter. A certificate can contain a single name, multiple names, or wildcard domains within the supported rules. TLS clients validate that the hostname they connected to is represented by the certificate, so a valid certificate for one domain does not authenticate an unrelated domain. Certificate transparency and private/public CA choices affect visibility and trust but do not change that hostname-to-certificate relationship.

Certificate placement follows the AWS endpoint that terminates TLS

ACM certificates are regional resources for most integrations. If the same application uses regional load balancers in multiple Regions, certificates generally need to exist in the corresponding Regions. CloudFront is a notable placement rule: ACM certificates used with a CloudFront distribution are requested or imported in US East (N. Virginia), after which CloudFront distributes the certificate to its edge infrastructure. This is an architectural detail, not a DNS property.

Managed renewal reduces operational risk only while the renewal conditions remain satisfied. DNS records used for validation should not be removed casually, and imported certificates have different renewal responsibilities than eligible ACM-issued certificates. When troubleshooting HTTPS, separate certificate issuance and trust from DNS resolution, network reachability, listener configuration, and application authorization; each is an independent layer.

Key takeaways

  1. 01

    ACM manages public and private X.509 certificates used for TLS/HTTPS on supported AWS integrations.

  2. 02

    DNS validation uses a CNAME record to prove domain control and supports automated managed renewal when its conditions remain satisfied.

  3. 03

    Public and private certificates solve different trust-distribution requirements.

  4. 04

    ACM certificates are generally regional; CloudFront uses ACM certificates from US East (N. Virginia).

  5. 05

    A TLS certificate secures and authenticates transport—it does not replace WAF, IAM, or application authorization.

Official AWS sources

Use these primary AWS resources for the source material behind this article and for deeper reference.