ACM Adds ACME Support for Public Certificates

AWS Certificate Manager now exposes an ACME endpoint, automating TLS certificate issuance for public domains.

What changed

• AWS Certificate Manager (ACM) now provides a managed ACMEv2 server endpoint.
• This endpoint issues public TLS certificates with a 45-day validity from Amazon Trust Services.
• Supports standard ACME clients like Certbot, cert-manager, and acme.sh.

Why it matters

This move directly addresses the growing complexity of managing public TLS certificates, especially with the CA/Browser Forum's push towards shorter lifetimes (mandating 47 days by 2029). The honest version: Manual certificate management is becoming untenable for many organizations. By supporting ACME, ACM provides a standards-based automation path, reducing operational overhead. PKI administrators gain centralized governance, allowing them to restrict domain scopes and wildcard usage for specific clients, while still enabling application teams to request certificates using familiar tools. This significantly simplifies the lifecycle of public certificates.

The catch

While the 45-day validity aligns with future mandates, it's still a relatively short window that requires robust automation. Watch out: The announcement does not specify any rate limits on the ACME endpoint itself, which could become a bottleneck for very large deployments. Furthermore, while ACM handles governance, the actual certificate issuance still relies on external ACME clients and their configurations, introducing potential points of failure outside of ACM's direct control.

Ship it

If you are currently managing public TLS certificates for your domains manually or with disparate automation tools, evaluate migrating to the ACM ACME endpoint. Pairs with: AWS CloudTrail for auditability and Amazon CloudWatch for operational metrics. Start by exploring the ACM documentation for endpoint configuration and client integration.

Bottom line: ACM now supports ACME, automating public certificate issuance and renewal for easier management.

— Filed to /aws