All Services
Security & IAM
AWS Certificate Manager
AWS Certificate Manager provisions, stores, deploys, and renews public and private TLS certificates for integrated AWS services, and supports exporting eligible public and private certificates for customer-managed deployment.
Explore pricing models, common use cases, infrastructure support, and the AWS services that commonly work with AWS Certificate Manager.
AWS Certificate Manager pricing and cost programs
Pricing model: Certificate issuance and export usage
- On-Demand
- Service-specific
- Reserved Instances or reserved capacity
- Not applicable
- Savings Plans
- Not applicable
- Spot
- Not applicable
Billing dimensions: Public certificate type · Exportable certificates · Private CA usage
Programs and modes: Non-exportable public certificates · Exportable public certificates · Private certificates
Non-exportable public certificates for integrated AWS services and exportable certificates have different pricing.
Free Tier: Service-specific — verify current offers
Pricing reviewed 2026-07-25. Reviewed against the linked official AWS pricing page. Recheck regional rates and program terms before purchase.
Official AWS pricing
Official AWS sources reviewed 2026-07-21.
Why implement AWS Certificate Manager?
- Automates issuance and renewal of Amazon-issued certificates used by supported AWS services, reducing manual certificate outages.
- Integrates with services such as CloudFront, Elastic Load Balancing, API Gateway, and other supported endpoints without exposing private keys for ordinary managed use.
- Supports public, imported, and Private CA-backed certificates, plus exportable public certificates for use cases that require deployment outside integrated services.
How to implement AWS Certificate Manager
- Inventory domain names, endpoint Regions, key and export requirements, validation control, ownership, renewal expectations, and whether public ACM, imported, or Private CA certificates fit.
- Request the certificate in the Region required by the consuming service, prefer DNS validation, create exact validation records, and associate the certificate with an eligible in-use AWS resource.
- Monitor renewal status and EventBridge events, keep validation records and endpoint associations intact, test replacement before expiry, and securely redeploy every renewed exported certificate and private key.
AWS Certificate Manager best practices
- Prefer DNS validation for durable automatic renewal, restrict DNS change access, and do not remove validation CNAMEs while certificates still depend on them.
- Use separate certificates and accounts where blast-radius or ownership requires it, request only necessary names, and monitor expiration and renewal even for managed certificates.
- Understand the boundary: ACM can renew eligible exported certificates, but customers must protect private keys and deploy the renewed certificate to external servers or devices.
AWS Certificate Manager use cases and server impact
- TLS for CloudFront and load balancers
- API and application certificates
- Exportable public or Private CA-issued certificates
Replaces much certificate issuance, storage, and renewal automation for integrated endpoints; exported and imported certificate deployment, DNS security, endpoint configuration, and trust decisions remain yours.
Official implementation resources
How AWS Certificate Manager works with other AWS services
Arrows show the documented technical direction. Reciprocal navigation does not imply a reverse technical dependency.
Official AWS sources reviewed 2026-07-25.
AWS Certificate Manager → Amazon CloudFront
CloudFront uses an ACM certificate attached to the distribution to terminate HTTPS for alternate domain names.
- Why teams use it
- Managed certificate renewal reduces manual certificate operations for public web delivery.
- Permissions and networking
- The viewer certificate must be requested or imported in us-east-1 and cover every alternate domain name on the distribution.
- Pricing and security caveats
- Public ACM certificates used with integrated services have no additional certificate charge, but CloudFront transfer and request charges still apply.
AWS Certificate Manager → Elastic Load Balancing
An HTTPS listener on an Application Load Balancer uses an ACM certificate to terminate TLS before forwarding requests to a target group.
- Why teams use it
- Central certificate management enables encrypted public endpoints without putting private keys on application instances or containers.
- Permissions and networking
- The certificate must exist in the same Region as the load balancer; listener security policies and backend encryption remain separate decisions.
- Pricing and security caveats
- The certificate and listener do not encrypt traffic from the load balancer to targets unless the target group also uses HTTPS.
Architecture patterns using this service