AWS Certificate Manager
AWS Certificate Manager
AWS Certificate Manager (ACM) API issues and manages SSL/TLS certificates — free public certificates, private CA management, auto-renewal, AWS service integration.
Public certificates are completely free
ACM certs are usable only on AWS services (cannot be downloaded for self-managed EC2 nginx)
POST /acm/RequestCertificate to request a certificate. DNS validation: add the returned CNAME record to DNS; auto-issued after validation.
Uptime · 30-day window
GitHub activity
About this API
ACM solves two major pain points of HTTPS certificate ops: cost (public SSL certs used to cost annually) and renewal (manual renewals were forgotten, causing outages). AWS productized something like Let's Encrypt — if your site runs on AWS (ALB, CloudFront, API Gateway), ACM issues certificates free, auto-binds them to resources, and auto-renews 60 days before expiry (for DNS validation). Downside: ACM certs are "bound" — you can't get the private key file, so they can't be used on self-managed nginx or non-AWS services. For downloadable certificates, use Let's Encrypt automation or ACM Private CA. For most AWS-hosted web apps, ACM is the out-of-the-box HTTPS standard.
What you can build
- 1Provide HTTPS certs for ALB/CloudFront/API Gateway
- 2Manage enterprise private CAs
- 3Auto-renewal to prevent expiry incidents
- 4Bulk certificate audit
Strengths & limitations
Strengths
- Public certificates are completely free
- Native integration with AWS services (ALB/CloudFront auto-binds)
- Auto-renewal (DNS validation scenarios)
- TLS private keys never exposed to users
Limitations
- ACM certs are usable only on AWS services (cannot be downloaded for self-managed EC2 nginx)
- Private CA service has monthly fee
Getting started
POST /acm/RequestCertificate to request a certificate. DNS validation: add the returned CNAME record to DNS; auto-issued after validation.
FAQ
Can I use ACM certs on self-managed nginx on EC2?+
Not directly (no private key access). Traffic must go through ALB or CloudFront first. Or use ACM Private CA (downloadable).
Are wildcard certificates supported?+
Yes. Request *.example.com — requires DNS validation.
Technical details
- Auth type
- unknown
- Pricing
- unknown
- Protocols
- REST
- SDKs
- python, javascript, go, java, csharp, php, ruby
- Response time
- 1254 ms
- Last health check
- 6/26/2026, 6:22:15 AM
More from Amazon Web Services
AWS IAM Access Analyzer API analyzes IAM resource policies for over-privileged access or external access — proactively surfaces security risks.
Alexa for Business helps you use Alexa in your organization.
Amazon API Gateway helps developers deliver robust, secure, and scalable mobile and web application back ends.
Use AppConfig, a capability of Amazon Web Services Systems Manager, to create, manage, and quickly deploy application configurations.
Welcome to the Amazon AppFlow API reference.
The Amazon AppIntegrations service enables you to configure and reuse connections to external applications.
Amazon AppStream 2.0 API Reference.
Amazon Athena is an interactive query service that lets you use standard SQL to analyze data directly in Amazon S3.