AWS Certificate Manager adds ACME protocol support for automated certificate management
This post details how AWS Certificate Manager (ACM) now supports the ACME protocol, allowing customers to automate public certificate issuance and renewal using familiar clients like certbot. This capability is crucial given upcoming CA/Browser Forum mandates for shorter certificate validity periods, which will increase renewal frequency. The feature provides a unified view of all certificates within ACM, regardless of how they were issued, and offers enhanced control for large-scale certificate management across hybrid and on-premises environments.
- →Automating certificate management with ACME protocol support
- →Unified certificate inventory and cross-environment management
- →ACME endpoint architecture for control and scalability
- →Enhanced security with EAB and domain scoping
- →Getting started with ACM's ACME feature
Notes (5) ›
- Automating certificate management with ACME protocol support
AWS Certificate Manager (ACM) now supports the ACME protocol, enabling the use of existing ACME clients such as certbot, cert-manager, acme.sh, and win-acme for automated public certificate issuance and renewal. This feature addresses the operational challenges of managing TLS certificates at scale, especially with the upcoming reduction in maximum certificate validity periods mandated by the CA/Browser Forum.
- Unified certificate inventory and cross-environment management
Certificates issued via ACME are registered within ACM, providing a single, unified view of all certificate inventory. This allows customers to manage certificates for infrastructure running on AWS, on-premises, or in hybrid environments using a standard ACME-compatible client pointed at ACM.
- ACME endpoint architecture for control and scalability
The feature introduces centrally managed ACME endpoints, each with a unique directory URL and IAM-based access controls. A control plane allows PKI administrators to create endpoints, pre-approve domains, and generate External Account Binding (EAB) credentials. The data plane uses these EABs for ACME clients to request certificates, with domain validation handled once at the endpoint level for scalability.
- Enhanced security with EAB and domain scoping
External Account Bindings (EABs) authenticate ACME clients to specific endpoints via IAM roles, creating security boundaries. DomainScope controls allow administrators to restrict certificate patterns that can be issued, with options for exact domains, subdomains, and wildcards, enhancing the security posture for production environments.
- Getting started with ACM's ACME feature
To begin using the ACME feature, users need an AWS account with ACM permissions, an installed ACME client, the AWS CLI, and a Route 53 hosted zone or equivalent DNS provider. The process involves creating an ACME endpoint, pre-approving domains, generating EAB credentials, and configuring the ACME client with the endpoint URL and credentials.
https://aws.amazon.com/blogs/security/automate-certificates-with-acme-support-in-aws-certificate-manager/
Related releases
- AppFolio Transforms Data Streaming with Amazon MSK Express Brokers AWS Big Data Blog ·
- AWS IAM Role Manager Automates Service Role Setup AWS What's New ·
- Amazon Quick Integrates Microsoft Purview for Data Loss Prevention AWS What's New ·
- Amazon QuickSight adds deny by default for new AI capabilities AWS What's New ·
- AWS Global View Adds Interactive Map for Regions and Local Zones AWS What's New ·
- AWS IAM Role Manager Streamlines Identity and Access Management Setup AWS Security Blog ·