Choosing how to issue certificates with Amazon
Amazon offers several ways to issue and manage X.509 certificates. Choose the option that best fits your use case.
| ACM | ACM with ACME | Amazon Private CA (direct issuance) | |
|---|---|---|---|
| Best for | Public or private certificates for Amazon integrated services (Elastic Load Balancing, CloudFront, API Gateway) | Public certificates for customer-managed infrastructure (on-premises, Kubernetes, hybrid) | Private certificates where you supply the CSR and manage the private key yourself |
| Certificate trust | Public (Amazon Trust Services) or private (via Amazon Private CA integration) | Public (Amazon Trust Services) | Private (your CA hierarchy) |
| Private key management | Amazon generates and manages the private key (you can export it for use outside Amazon) | Your ACME client generates and holds the private key | You generate and hold the private key |
| Renewal | ACM managed renewal (automatic) | Client-driven (your ACME client renews before expiry) | Manual (you call IssueCertificate again) |
| Deployment | Bound to Amazon integrated services, or exported for use anywhere | Installed on your systems by the ACME client | You install the certificate on your systems |
| Automation | Amazon SDK and CLI | Industry-standard ACME clients (Certbot, cert-manager, acme.sh) | Amazon SDK and CLI |
- Amazon Certificate Manager (ACM)
-
Use ACM when you need certificates for Amazon integrated services such as Elastic Load Balancing, Amazon CloudFront, and Amazon API Gateway, or when you want Amazon to manage the certificate lifecycle including renewal. ACM generates and manages the private key and automates renewal. For workloads outside of Amazon integrated services, ACM also supports exportable certificates that let you retrieve the private key and use the certificate on your own infrastructure. ACM can issue public certificates from Amazon Trust Services or private certificates when integrated with Amazon Private CA.
- ACM with ACME certificate automation
-
Use ACME when you need publicly trusted certificates for customer-managed infrastructure and want to automate the lifecycle using industry-standard ACME clients (Certbot, cert-manager, acme.sh) rather than Amazon APIs. The private key is generated and held by your ACME client and never leaves your systems. Certificates issued through ACME appear in your ACM inventory for central visibility but cannot be bound to Amazon integrated services. For more information, see ACME certificate automation.
- Amazon Private CA (direct issuance)
-
Use Amazon Private CA directly when you need private certificates and want full control over the private key. You create your own CA hierarchy, generate your own private key and CSR, and call
IssueCertificate. Certificates issued by a private CA are not publicly trusted and cannot be used on the public internet. For more information, see the Amazon Private CA User Guide.Note
Amazon Private Certificate Authority is not available in the Beijing and Ningxia Regions.
Both ACM and ACME certificate automation are covered in this guide. You are in the right place.