AWS Certificate Manager Adds ACME Support for Automated TLS
Cloud Platform EngineeringUntil now, automating TLS certificate management in AWS meant choosing between ACM’s managed renewal and an external certificate authority for ACME clients. ACM just added a third option: its own managed ACME server endpoint.
What Happened
AWS Certificate Manager now provides a fully managed ACME server endpoint, enabling organizations to issue and automatically renew public TLS certificates from Amazon Trust Services using the industry-standard ACME protocol (RFC 8555). The service supports Certbot, cert-manager for Kubernetes, acme.sh, and any ACMEv2-compatible client without requiring changes to how those tools are configured.
The workflow: PKI administrators create a dedicated ACME endpoint, configure External Account Binding (EAB) credentials, and distribute those credentials to application teams. For Route 53 users, domain validation is automatic via CNAME record creation. Certificates are issued in ECDSA P-256, P-384, and RSA 2048. Coverage is currently all commercial AWS regions; GovCloud and China regions come later.
Why It Matters
Organizations that needed ACME client support — typically for automating certificates on workloads not managed inside AWS-native services — previously had to use an external CA like Let’s Encrypt alongside ACM. This created fragmented visibility: some certificates tracked in ACM, others managed externally with no centralized audit trail.
The managed ACME endpoint closes that gap. PKI administrators can enforce domain policies and certificate type restrictions at the endpoint level, and monitor every certificate request through AWS CloudTrail and CloudWatch. Certificate governance — who can request what, for which domains — is enforced through IAM policy rather than managed per external CA.
For Kubernetes environments, the cert-manager integration matters most. cert-manager is the de facto standard for in-cluster certificate lifecycle management, and it can now source certs from Amazon Trust Services rather than requiring a separate CA integration. Teams running workloads on EKS get a cleaner path to centralized cert governance without adding an external dependency.
The So What
If your organization has any workloads using ACME clients pointed at Let’s Encrypt or another external CA, evaluate migrating to the ACM ACME endpoint. The governance improvement — centralized visibility, IAM-controlled domain scoping, CloudTrail audit trail — is significant for compliance-oriented teams. The endpoint is available now in all commercial AWS regions; no migration window needed.
Source: AWS News Blog
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →