AWS Certificate Manager Now Supports ACME Protocol for Public Certificates

Amazon Web Services (AWS) has rolled out a significant update to its Certificate Manager (ACM) service, introducing support for the Automatic Certificate Management Environment (ACME) protocol for public certificates. This new capability enables AWS customers to automate the entire lifecycle of public Transport Layer Security (TLS) certificates, from issuance to renewal, directly through ACM. The timing of this release is particularly relevant as industry standards, set by the CA/Browser Forum, are moving towards shorter certificate validity periods, which will soon decrease to as little as 47 days. This change necessitates more efficient and automated certificate management solutions to prevent service disruptions. Previously, organizations relying on ACME for certificate automation often had to manage certificates through external Certificate Authorities, even if they used ACM for other certificates. This led to fragmented oversight and inconsistent policy controls. The new integration aims to consolidate these processes within ACM, providing a unified platform for managing all public TLS certificates. The ACME protocol is an open standard widely adopted across web infrastructure, supported by popular clients like Certbot and cert-manager for Kubernetes. With this update, customers can now utilize any ACMEv2-compatible client to interact with a managed ACME server endpoint within AWS Certificate Manager. Public certificates issued through this mechanism are backed by Amazon Trust Services. Beyond simplified automation, the new feature enhances security and operational control. PKI teams can establish multiple ACME endpoints, define domain restrictions for each endpoint, and specify which domains individual clients are authorized to request certificates for. Furthermore, AWS has integrated these controls with its existing identity and monitoring services. IAM roles can be linked to ACME accounts via External Account Binding, while AWS CloudTrail meticulously logs all certificate requests. Amazon CloudWatch also provides operational metrics, and ACM continues to send expiry notifications to ensure timely renewals. This comprehensive approach helps organizations maintain a robust security posture while adapting to evolving certificate management requirements.