AWS Certificate Manager adds ACME protocol support

AWS has integrated the Automatic Certificate Management Environment (ACME) protocol into its Certificate Manager (ACM) service, allowing users to automate the issuance, renewal, and revocation of public TLS certificates. This update addresses the growing operational burden of manual certificate management as validity periods continue to shorten, with industry standards set to reduce maximum validity to 100 days by March 2027 and further to 47 days by 2029.

The ACME protocol, widely adopted by certificate authorities like Let’s Encrypt, eliminates the need for human intervention in certificate lifecycle management. AWS’s implementation provides a fully managed ACME server endpoint compatible with any ACMEv2 client, including Certbot, cert-manager for Kubernetes, and acme.sh. This integration consolidates certificate management within ACM, offering a unified dashboard for monitoring and controlling certificate issuance across an organization.

How it works

To use ACME in ACM, administrators first create a dedicated ACME endpoint in the AWS Console or via API. The setup process involves configuring domain validation, defining certificate scopes (e.g., exact domains, subdomains, or wildcards), and generating External Account Binding (EAB) credentials for client authentication. Domain validation is centralized, with ACM automatically creating DNS CNAME records for domains hosted in Amazon Route 53 or providing manual instructions for external DNS providers.

Once the endpoint is configured, application owners can request certificates using their preferred ACME client. The client registers with the ACME endpoint using EAB credentials, which bind to IAM roles for granular access control. This ensures that only authorized users can request certificates for approved domains, while PKI administrators retain centralized oversight. All certificate requests are logged in AWS CloudTrail for auditing, and operational metrics are tracked in Amazon CloudWatch, with expiry notifications sent via ACM.

Centralized controls and governance

ACME support in ACM introduces several governance features that were previously unavailable. Administrators can enforce organization-wide policies by restricting certificate types (e.g., ECDSA or RSA) and limiting wildcard issuance at the endpoint level. Domain scopes can be configured to allow only specific certificate patterns, such as exact domains or subdomains, while excluding wildcards to enhance security. These controls reduce the risk of misissued certificates and eliminate the need for third-party certificate lifecycle management tools.

The integration also improves visibility. All certificates issued through ACME, the ACM console, or API calls are searchable within ACM, providing a single pane of glass for monitoring certificate usage. This addresses a common pain point for organizations that previously relied on external certificate authorities alongside ACM, resulting in fragmented visibility and inconsistent policy enforcement.

Availability and pricing

ACME support in ACM is available in all commercial AWS Regions as of June 2026. Support for AWS GovCloud (US), China Regions, and the AWS European Sovereign Cloud is planned for a later date. Pricing is based on the number of domains included in each certificate at issuance, with separate rates for fully qualified domain names and wildcards. Volume discounts apply based on total domain occurrences across all certificates issued per month in an AWS account. Detailed pricing information is available on the ACM pricing page.

What to watch

The adoption of ACME in ACM is likely to accelerate as organizations prepare for the upcoming reduction in certificate validity periods. The ability to automate certificate management while maintaining centralized control may also influence enterprise decisions about consolidating certificate authorities. Operators should evaluate their current ACME client configurations and IAM policies to ensure compatibility with ACM’s implementation, particularly for organizations using multiple AWS accounts or hybrid cloud environments.