AWS Certificate Manager

Manages the certificates required for HTTPS.

Issues and manages SSL/TLS certificates. Used to enable HTTPS communication on CloudFront and ALB.

• Enabling HTTPS on CloudFront with custom domains
• HTTPS listener for ALB
• Automated certificate renewal

• Manages SSL/TLS certificates
• Integrates with AWS services to enable HTTPS
• Issues public certificates

• Issue certificates in us-east-1 for use with CloudFront
• Use DNS validation to make automatic renewal easier
• Pay attention to the region of the certificate

ACM is a service that issues and manages SSL/TLS certificates, integrating with AWS services such as CloudFront, ALB, and API Gateway so that HTTPS communication can be configured with minimal effort. The most common real-world scenario is enabling HTTPS for websites that use a custom domain. By issuing a public certificate from ACM for a domain obtained via Route 53 and attaching it to a CloudFront distribution or an ALB listener, HTTPS delivery — including automatic certificate renewal — is complete. As the expiration date approaches, AWS automatically renews the certificate, which structurally reduces the risk of expiration-related incidents and is the biggest advantage compared to managing certificates manually. A key consideration when working with ACM is the region constraint of certificates. A certificate attached to an ALB must be issued in the same region as the ALB. On the other hand, because CloudFront is a global service, certificates attached to CloudFront must always be issued in us-east-1 (N. Virginia). Certificates issued in the wrong region cannot be selected from a CloudFront distribution, which is a common pitfall for beginners. ACM also distinguishes between public and private certificates: public certificates are used for internet-facing systems, while private certificates issued by ACM Private CA are used for internal systems. CLF-C02 / SAA-C03 frequently ask questions like "Which service is used to enable HTTPS?" and "In which region must a certificate for CloudFront be issued?". The difference between DNS validation and email validation is also a common topic. DNS validation, when combined with Route 53, can fully automate the renewal process, which is why it is the recommended option in production.

• AWS Certificate Manager (AWS Official)
• What is AWS Certificate Manager (AWS Official Documentation)
• Issuing ACM Certificates Using DNS Validation (AWS Official Documentation)

Last updated: 2026-06-01