AWS Certificate Manager
AWS Certificate Manager (ACM) provisions, manages, and deploys public and private SSL/TLS certificates for AWS, hybrid, and multicloud workloads.
What AWS Certificate Manager is
AWS Certificate Manager (ACM) provisions, manages, and deploys public and private SSL/TLS certificates for AWS, hybrid, and multicloud workloads. Certificates can cover a single domain, several named domains, wildcard domains, or combinations. Users can manage them through the AWS Management Console, AWS CLI, or ACM APIs, and review certificate use in AWS CloudTrail logs.
For Amazon-issued certificates, ACM manages renewal: DNS-validated certificates renew automatically, while email notices go out as expiration approaches otherwise. Public-certificate integrations include Elastic Load Balancing, Amazon CloudFront, Amazon API Gateway, AWS Elastic Beanstalk, and AWS CloudFormation. AWS Key Management Service helps protect private keys that ACM stores. Customers can also import third-party CA certificates and deploy them with Elastic Load Balancers, CloudFront, and API Gateway; importing certificates costs nothing. The default limit is 10 domain names per certificate, with requests available to raise it to 100. Public certificates for integrated AWS services are listed as free and are non-exportable.
Good
- Managed renewal for Amazon-issued certificates
- Manage certificates through console, CLI, or APIs
- Integrates with several named AWS services
- Third-party certificate imports cost nothing
Watch out
- Free integrated-service public certificates are non-exportable
- Default certificate quota is 10 domain names
- Automatic renewal requires DNS validation
Who it suits
ACM suits teams managing SSL/TLS certificates for websites, applications, or communications between connected resources such as servers, mobile and IoT devices, and applications. It is especially relevant when AWS integrations and managed certificate renewal fit the workload.
Verdict
ACM centralizes certificate management and offers renewal support for Amazon-issued certificates. Check exportability, the domain quota, and how renewal validation works for your setup.
Plans and prices
From AWS Certificate Manager's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Public certificate for integrated AWS services | Free | Non-exportable · for integrated AWS services |
| ACME public certificates | — | First 1k FQDNs: $1.00/domain · next 3k FQDNs: $0.50/domain · 4k+ FQDNs: $0.25/domain · first 500 wildcard domains: $5.00/domain · 500+ wildcard domains: $2.50/domain · first 30k API calls: $0 · next 10,000 API calls: $.50 · Per account per month; charged per domain at issuance and each automatic renewal |
| Exportable public certificates | — | First 10K export-certificate API calls: $0 per account per month · next 10,000 API calls: $0.50 per 10k per account per month · Upon issuance and again only on certificate renewal |
The facts
Each one read from AWS Certificate Manager's own pages, with the date it was checked.
What it does
- Automatic renewal
- ACM provides managed renewal for Amazon-issued SSL/TLS certificates, renewing automatically when DNS validation is used or sending email notices as expiration approaches.checked 4 Oct 2026
- AWS launch
- Amazon Web Services says it launched in 2006.checked 4 Oct 2026
- Certificate management
- Certificates can be centrally managed from the AWS Management Console, AWS CLI, or ACM APIs, and their use can be audited through AWS CloudTrail logs.checked 4 Oct 2026
- Certificate types
- ACM supports certificates for singular domain names, multiple specific domain names, wildcard domains, or combinations of these.checked 4 Oct 2026
- Integrations
- ACM integrates with Elastic Load Balancing, Amazon CloudFront, Amazon API Gateway, AWS Elastic Beanstalk, and AWS CloudFormation for public certificates.checked 4 Oct 2026
- Key security
- ACM uses AWS Key Management Service to help protect certificate private keys that it stores.checked 4 Oct 2026
- Notable quota
- The default quota is 10 domain names per ACM certificate, and customers can request up to 100 domain names.checked 4 Oct 2026
- Purpose
- AWS Certificate Manager provisions, manages, and deploys public and private SSL/TLS certificates for AWS, hybrid, and multicloud workloads.checked 4 Oct 2026
- Third-party certificates
- ACM allows customers to import third-party CA certificates and deploy them with Elastic Load Balancers, CloudFront, and APIs on API Gateway; importing certificates does not cost anything.checked 4 Oct 2026
- Who it is for
- AWS says ACM can protect websites and applications and secure communication between connected resources such as servers, mobile and IoT devices, and applications.checked 4 Oct 2026
Alternatives to AWS Certificate Manager
- 1
EJBCA
Free planOpen sourceWebAPILinuxmacOS8.2From £62,065 a year - 2
Certify The Web
Free planWebAPILinuxmacOS7.7From $59 a year - 3
KeyTalk CKMS
AndroidiOSWebAPI7.7From €5 a month - 4
Let's Encrypt
Free planOpen sourceWebAPILinuxmacOS7.6Free plan - 5
ManageEngine Key Manager Plus
Free planWebAPILinuxSelf-hosted7.6From $475 a year - 6
GeoTrust
Free planWebAPILinuxWindows6.9From $2 a month