TLS Certificate

A TLS Certificate (formerly SSL certificate) is a digital certificate that authenticates a website's identity and enables an encrypted HTTPS connection. It ensures data in transit between the user's browser and your server cannot be intercepted.

AWS Certificate Manager (ACM)

• Free public certificates for CloudFront, ALB, API Gateway, and other AWS services
• Automatic renewal, so no more expired certificate outages
• DNS or email validation
• Private CA for internal certificates

Region Rules That Trip People Up

ACM certificates are regional resources, and the placement rules are strict:

• CloudFront: the certificate must exist in us-east-1, regardless of where your origin or your team operates. CloudFront is a global service and only accepts certificates from that region.
• ALB, NLB, API Gateway: the certificate must be in the same region as the resource. An ALB in eu-west-3 needs a certificate issued in eu-west-3.
• If you serve the same domain in several regions, you request a certificate in each region, and each one renews independently. The ARN stays stable across renewals, so downstream references never need updating.

Where TLS Terminates

A certificate is only half the design; the other half is deciding where the encrypted connection ends. With CloudFront, TLS from the viewer terminates at the edge; with an ALB, it terminates at the load balancer. In both cases the hop from there to your origin or targets is a separate connection with its own encryption decision. Terminating at the edge and forwarding in cleartext inside the VPC is a real architectural choice with real trade-offs, and compliance frameworks that require end-to-end encryption in transit will force you to re-encrypt on the backend hop. Decide it explicitly per workload rather than inheriting whatever the first deployment did.

How It Goes Wrong in Practice

The recurring incident is the silent renewal gap. Automatic renewal is not unconditional, and three cases regularly bite teams:

• Imported certificates are not eligible for managed renewal. A team imports a certificate bought elsewhere into ACM, attaches it to an ALB, and assumes ACM now owns the lifecycle. It does not. The certificate expires on schedule, TLS handshakes start failing, and the outage looks like a network problem until someone checks the certificate dates.
• Email validation blocks automation. Certificates validated by email generate renewal notices that a human must act on. If the validation mailbox belongs to someone who left the company, the notices go nowhere. DNS validation is the fix: keep the ACM validation CNAME records in place and renewal is fully automatic.
• Private CA certificates issued through the IssueCertificate API are not renewed by ACM either; only private certificates requested through ACM itself (and then associated with a service or exported) are eligible.

Practical Check: Find Certificates Approaching Expiry

List every certificate in a region with its domain and expiry date:

aws acm list-certificates --query "CertificateSummaryList[].[DomainName,NotAfter,RenewalEligibility,CertificateArn]" --output table

Two fields matter here. NotAfter is the expiration timestamp. RenewalEligibility tells you whether ACM will even attempt a managed renewal: any certificate showing INELIGIBLE that is still attached to production traffic needs a manual renewal plan. You can also filter to problem states directly with --certificate-statuses EXPIRED VALIDATION_TIMED_OUT. Run this per region, including us-east-1 for CloudFront certificates, and wire the output into a scheduled check rather than trusting memory.

Frequently Asked Questions

Why does my CloudFront distribution not show my certificate?

Almost always because the certificate was requested in the wrong region. CloudFront only reads certificates from us-east-1. Request (or re-request) the certificate there; since ACM public certificates are free, duplicating a certificate across regions costs nothing but the validation step.

Does ACM renew every certificate automatically?

No. Amazon-issued certificates using DNS validation renew automatically as long as the validation records remain in your DNS zone and the certificate is in use or has been exported. Email-validated certificates require human action on renewal notices, and imported or already-expired certificates are not eligible for managed renewal at all.

Can I get the private key out of ACM?

Classic ACM public certificates are designed to be deployed on integrated AWS services without exposing the private key. ACM does support an export option on certificates, surfaced through the ExportOption and Exported fields in the certificate summary, and private certificates from ACM Private CA can be exported for use on your own servers. If your architecture depends on holding the private key on non-AWS infrastructure, decide that before issuance rather than after.