AWS Certificate Manager (ACM)

ACM issues the public certificates by Amazon Trust Services, and all major browsers and operating systems trust these certificates. Each certificate must be associated with at least one domain name. It also supports RSA and Elliptic Curve Digital Signature Algorithm (ECDSA) key algorithms for certificate issuance. By default, the ACM certificate is valid for a period of 13 months. However, ACM uses OffSec Certified Professional (OSCP) and certificate revocation list (CRL) to revoke untrustworthy certificates.

How ACM works

We start by requesting SSL/TLS certificates directly through the AWS Management Console, CLI, or API. ACM supports various types of certificates, including single-domain, multi-domain (SAN), and wildcard certificates. When we request a certificate, ACM automatically validates our domain ownership to ensure security. ACM handles the entire lifecycle of SSL/TLS certificates, including issuance, renewal, and deployment. It automatically renews certificates before they expire, ensuring continuous security without manual intervention. This automation simplifies certificate management and reduces the risk of expired certificates.

Once we’ve obtained SSL/TLS certificates through ACM, we integrate them with other AWS services. For example, we can associate certificates with Elastic Load Balancers (ELB), CloudFront distributions, API Gateway APIs, and Amazon CloudFront distributions. ACM seamlessly manages the certificate lifecycle for these services.

Best practices

Here are some best practices for using AWS Certificate Manager (ACM):

• Use DNS validation: Whenever possible, opt for DNS validation instead of email validation when requesting ACM certificates. DNS validation provides a more secure and automated method for verifying domain ownership.

• Limit certificate access: Restrict access to ACM certificates using AWS Identity and Access Management (IAM) policies. Only grant permissions to users and roles that require access to the certificates for our respective tasks.

• Monitor certificate expiry: Regularly monitor the expiry dates of ACM certificates using AWS CloudWatch or other monitoring tools. Set up alerts to notify us when certificates are nearing expiration, allowing us to take timely action to renew them.

• Use managed renewal: Enable managed renewal for ACM certificates to automate the process of renewing certificates before they expire. This helps prevent downtime due to expired certificates and ensures continuous protection for our applications.

• Regularly review and rotate certificates: Conduct periodic reviews of ACM certificates to ensure that they are still required and properly configured. Rotate certificates if there are changes in our infrastructure or security requirements.

• Backup private keys: Although ACM does not provide direct access to private keys, ensure that backup mechanisms are in place for storing and managing private keys associated with ACM certificates securely.