AWS for DevOps — ACM Certificates

12.4 — ACM Certificates

AWS Certificate Manager (ACM) provides free SSL/TLS certificates for your domains. No more paying for certificates or manually renewing them.

Real-World Analogy

ACM is like a free, auto-renewing passport office. You apply once, prove your identity (domain validation), and get a passport (certificate) that’s automatically renewed before it expires. You never have to visit the office again.

How ACM Works

  1. Request Certificate          2. Validate Domain
  ┌──────┐     ┌─────┐           ┌──────────┐
  │ You  │────→│ ACM │──────────→│ Route 53 │
  └──────┘     └──┬──┘  CNAME    │ (DNS)    │
                  │    record     └──────────┘
                  │
  3. Certificate Issued           4. Attach to ALB/CloudFront
  ┌──────────────┐                ┌─────────┐
  │ Certificate  │───────────────→│ ALB     │
  │ (auto-renew) │               │CloudFront│
  └──────────────┘               └─────────┘

Requesting a Certificate

# Request a certificate for your domain
$ aws acm request-certificate \
    --domain-name example.com \
    --subject-alternative-names "*.example.com" \
    --validation-method DNS
{
    "CertificateArn": "arn:aws:acm:ap-south-1:123456789012:certificate/abc123-def456"
}

# Get the DNS validation record
$ aws acm describe-certificate \
    --certificate-arn arn:aws:acm:ap-south-1:123456789012:certificate/abc123-def456 \
    --query 'Certificate.DomainValidationOptions'
[
    {
        "DomainName": "example.com",
        "ValidationStatus": "PENDING_VALIDATION",
        "ResourceRecord": {
            "Name": "_abc123.example.com.",
            "Type": "CNAME",
            "Value": "_def456.acm-validations.aws."
        }
    }
]

DNS Validation with Route 53

# Add the validation CNAME record to Route 53
$ aws route53 change-resource-record-sets \
    --hosted-zone-id Z1234567890 \
    --change-batch '{
      "Changes": [{
        "Action": "CREATE",
        "ResourceRecordSet": {
          "Name": "_abc123.example.com.",
          "Type": "CNAME",
          "TTL": 300,
          "ResourceRecords": [{"Value": "_def456.acm-validations.aws."}]
        }
      }]
    }'

# Wait for validation (usually 5-30 minutes)
$ aws acm wait certificate-validated \
    --certificate-arn arn:aws:acm:ap-south-1:123456789012:certificate/abc123-def456

Attaching to an ALB

# Create an HTTPS listener with the ACM certificate
$ aws elbv2 create-listener \
    --load-balancer-arn arn:aws:elasticloadbalancing:...:loadbalancer/app/my-alb/abc123 \
    --protocol HTTPS \
    --port 443 \
    --certificates CertificateArn=arn:aws:acm:ap-south-1:123456789012:certificate/abc123-def456 \
    --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:...:targetgroup/api-targets/def456

# Add HTTP → HTTPS redirect
$ aws elbv2 create-listener \
    --load-balancer-arn arn:aws:elasticloadbalancing:...:loadbalancer/app/my-alb/abc123 \
    --protocol HTTP \
    --port 80 \
    --default-actions '[{
      "Type": "redirect",
      "RedirectConfig": {
        "Protocol": "HTTPS",
        "Port": "443",
        "StatusCode": "HTTP_301"
      }
    }]'

Certificate Types

Type	Validation	Time	Use Case
DNS validation	Add CNAME record	5-30 min	Automated (recommended)
Email validation	Click link in email	Minutes to hours	When you can’t modify DNS

Important Rules

Rule	Details
ACM certificates are free	No cost for public certificates
Auto-renewal	ACM renews before expiration (if DNS validation record exists)
Regional	Certificates are region-specific
CloudFront requires us-east-1	Must create cert in us-east-1 for CloudFront
Can’t export	ACM certs can only be used with AWS services

Common Mistakes

Mistake	Why It Hurts	Fix
Creating cert in wrong region for CloudFront	CloudFront can’t use it	Create in us-east-1 for CloudFront
Removing DNS validation record	Certificate can’t auto-renew	Keep CNAME records permanently
Using email validation	Harder to automate	Always use DNS validation
No HTTP → HTTPS redirect	Users access over HTTP	Add redirect listener on port 80

Quick Reference

Task	Command
Request certificate	aws acm request-certificate --domain-name DOMAIN --validation-method DNS
Describe certificate	aws acm describe-certificate --certificate-arn ARN
List certificates	aws acm list-certificates
Delete certificate	aws acm delete-certificate --certificate-arn ARN
Wait for validation	aws acm wait certificate-validated --certificate-arn ARN

---

Next → WAF Basics