What it is
AWS Certificate Manager, ACM, issues and manages TLS certificates for AWS services. Public certificates used with services like CloudFront and load balancers are free, and ACM renews them automatically before they expire, as long as the domain validation record stays in place. Private certificates for internal systems are also available.
Validation is usually by DNS: ACM gives a record to add, and once it exists the certificate is issued and kept renewed. Certificates for CloudFront are created in the us-east-1 region. Domain owners can publish CAA records naming Amazon so that no other authority can issue certificates for their domain.
How I use it
- Every Rental Pilot tenant domain gets its own certificate, issued and renewed by ACM, so customers manage none.
- Lend Pilot creates a managed certificate for each lender's domain as part of onboarding.
- mervinc.com serves TLS 1.3 with ACM certificates, and CAA records allow only Amazon to issue for mervinc.com and mervinc.ca.
- The status board reads certificate expiry once an hour.
- Small client sites get a free, auto-renewing certificate on CloudFront.
ACM is the right choice whenever TLS ends at an AWS service like CloudFront: free certificates that renew themselves remove a whole class of outage. For a SaaS with a domain per customer, it is the only sane way to manage hundreds of certificates.
Questions
Do I have to renew SSL certificates for my domain?
Not on what I host. ACM certificates renew automatically, and the status board checks expiry every hour anyway.
What is a CAA record?
A DNS record naming which certificate authorities may issue for your domain. Mine allow only Amazon.