AWS Certificate Manager adds ACME protocol support for automated certificate management

AWS Certificate Manager (ACM) now supports the ACME protocol, enabling the use of existing ACME clients such as certbot, cert-manager, acme.sh, and win-acme for automated public certificate issuance and renewal. This feature addresses the operational challenges of managing TLS certificates at scale, especially with the upcoming reduction in maximum certificate validity periods mandated by the CA/Browser Forum.

Certificates issued via ACME are registered within ACM, providing a single, unified view of all certificate inventory. This allows customers to manage certificates for infrastructure running on AWS, on-premises, or in hybrid environments using a standard ACME-compatible client pointed at ACM.

The feature introduces centrally managed ACME endpoints, each with a unique directory URL and IAM-based access controls. A control plane allows PKI administrators to create endpoints, pre-approve domains, and generate External Account Binding (EAB) credentials. The data plane uses these EABs for ACME clients to request certificates, with domain validation handled once at the endpoint level for scalability.

External Account Bindings (EABs) authenticate ACME clients to specific endpoints via IAM roles, creating security boundaries. DomainScope controls allow administrators to restrict certificate patterns that can be issued, with options for exact domains, subdomains, and wildcards, enhancing the security posture for production environments.

To begin using the ACME feature, users need an AWS account with ACM permissions, an installed ACME client, the AWS CLI, and a Route 53 hosted zone or equivalent DNS provider. The process involves creating an ACME endpoint, pre-approving domains, generating EAB credentials, and configuring the ACME client with the endpoint URL and credentials.