AWS Certificate Manager Now Speaks ACME: How to Automate Public TLS Certificates Before 47-Day Renewals Arrive
Every engineering leader has a certificate story, and none of them are good. A wildcard cert expires on a Saturday and the mobile app stops talking to the API. A renewal reminder email goes to someone who left the company eight months ago. A checkout page starts throwing browser warnings during your busiest trading week. Certificate expiry is one of the most preventable outages in tech, and yet it keeps happening because renewal still depends on a human remembering to do something. That problem is about to get much worse. The CA/Browser Forum has mandated that maximum certificate validity drops to 100 days from March 2027 and to just 47 days by 2029. If your team renews certificates by hand today, you are looking at doing that job roughly eight times more often within three years.
The short answer: AWS Certificate Manager now supports the ACME protocol for public TLS certificates, announced on 30 June 2026. ACM provides a fully managed ACME server endpoint that works with any ACMEv2-compatible client, including Certbot, cert-manager for Kubernetes, and acme.sh. That means you can now automate issuance and renewal of publicly trusted certificates from Amazon Trust Services on any workload, including EC2 instances, containers, on-premises servers, and anywhere else an ACME client runs, while your PKI admin keeps centralized governance, IAM-based access control, and domain scoping in one place.
Why This Matters More Than It Sounds
ACM has always been excellent at one specific job: free, auto-renewing certificates for AWS managed services like Application Load Balancers, CloudFront, and API Gateway. The catch was that you could never export those certificates or use them on anything that terminated TLS itself. If you ran nginx on EC2, a self-managed Kubernetes ingress, an on-premises appliance, or any software that needed the actual certificate files, ACM could not help you. So teams bolted on Let’s Encrypt with Certbot, or bought commercial certs, or built fragile renewal scripts. The result at most scale-ups is a certificate estate split across three or four systems, with no single view of what expires when, and no control over who can request what.
ACME support closes that gap. The same open protocol that powers Let’s Encrypt now works against a managed endpoint in your AWS account, issuing browser-trusted certificates from Amazon Trust Services. Your existing ACME clients keep working, you just point them at a new server URL. The difference is that every certificate request now lands in CloudTrail, every certificate is searchable in the ACM console alongside your managed-service certs, and expiry notifications and CloudWatch metrics come built in.
The Governance Angle Founders Should Not Skip
The clever part of this launch is not the protocol support, it is the separation of duties. In a typical Let’s Encrypt setup, whoever runs the ACME client also needs the ability to prove domain ownership, which usually means handing DNS API credentials to every server and cluster that requests certificates. Anyone who has audited that setup knows how uncomfortable it gets. DNS keys with broad write access end up scattered across dozens of workloads, and any one of them getting compromised is a very bad day.
ACM’s model splits this cleanly. The PKI administrator validates the domain once, at the endpoint level, using DNS credentials that never leave the admin’s hands. If your zone is in Route 53, ACM creates the validation CNAME records automatically. Application teams then register their ACME clients using External Account Binding credentials, which are a key ID and HMAC key pair the admin issues and can expire. The endpoint enforces which domains and which certificate patterns each client can request. You can allow exact domains and subdomains while blocking wildcard issuance entirely, restrict key types to ECDSA or RSA, and bind IAM roles to ACME accounts for fine-grained access control. Certificate automation gets distributed across the organisation without DNS keys going along for the ride.
What Changes Operationally
For a team already using cert-manager on EKS or Certbot on EC2, migration is mostly configuration. You create an ACME endpoint in the ACM console, validate your domain, generate EAB credentials, and update your client’s server URL and registration settings. The console gives you ready-to-use command examples for Certbot and acme.sh. From then on, issuance and renewal happen without human involvement, and your security team gets one dashboard instead of four.
There is one notable difference from Let’s Encrypt: this is not free. Pricing is per domain included in each certificate at issuance, with separate rates for fully qualified domain names and wildcards, and volume tiers calculated monthly across your account. For many businesses that trade is worth making, because what you are buying is not the certificate, it is the audit trail, the access control, and the single pane of glass. Companies currently paying for a commercial certificate lifecycle management product, or maintaining a homegrown policy layer around Let’s Encrypt, should run the numbers carefully. The feature is available today in all commercial AWS Regions, with GovCloud, China, and the European Sovereign Cloud to follow.
What to Do About It
Start with an inventory. Most teams underestimate how many certificates they actually run, so pull the list from ACM, from your DNS provider, from Certbot renewal configs, and from anything your monitoring flags on port 443. Then classify each certificate by how it renews today. Anything attached to an ALB or CloudFront is already automated and can stay put. Anything renewed by hand is your risk register, and those are the first candidates to move to the new ACME endpoint. If you run Kubernetes, plan a cert-manager issuer pointed at ACM and test it in a non-production cluster first. Finally, set a calendar reminder for March 2027. When 100-day validity arrives, any certificate that still needs a human in the loop will need attention nine times more often than an annual cert does today, and the teams that automated early will not notice the change at all.
Certificate automation is one of those projects that never feels urgent until the outage happens. If you would like help auditing your certificate estate, setting up ACME endpoints with proper governance, or building a migration plan off manual renewals, HAZERCLOUD offers a free consultation and migration assessment. Get in touch at https://hazercloud.com/contact/ and we will help you make certificate expiry someone else’s war story, not yours.
