JA EN
shiichan

ACM's ACME Issuance Now Works Over AWS PrivateLink, No Client Changes!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hi, it's Shii-chan! Today there's some nice certificate news from AWS What's New.

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, AWS Certificate Manager (ACM) now supports AWS PrivateLink for ACME public certificate issuance. You can request and renew public TLS certificates over a private network path that stays within the AWS network.

You create a VPC interface endpoint to the ACM ACME service and route issuance traffic from any ACMEv2-compatible client through your VPC.

The story so far

The announcement doesn't describe the earlier path in detail. My reading is that, before PrivateLink support, ACME issuance requests didn't have a private path, so locked-down VPCs may have needed an outbound route.

What changes

  • Issuance and renewal traffic can stay inside the AWS network
  • If you already use ACME with ACM, your ACME clients need no changes
  • Activity stays visible in the ACM console, AWS CloudTrail, and Amazon CloudWatch metrics

That's great news for teams with tightly restricted networks or audit requirements.

Dive Deep

The setup flow looks like this:

  • Create your managed ACME endpoint in ACM
  • Create a standard VPC interface endpoint using the VPC console, AWS CLI, or AWS CloudFormation
  • Private DNS automatically resolves your existing ACME directory URL to the interface endpoint inside your VPC

So your client configuration and directory URL stay the same. These operations flow over PrivateLink:

  • Account creation
  • Order creation
  • Domain validation
  • Finalization
  • Certificate retrieval

Availability and pricing:

  • Regions: all commercial AWS Regions
  • Pricing: standard AWS PrivateLink charges apply for interface endpoints; see the ACM pricing page for ACM itself

For details, see the AWS News blog post and the ACM ACME documentation (https://docs.aws.amazon.com/acm/latest/userguide/acm-acme.html).

Wrap-up

  • ACME public certificate issuance and renewal in ACM now supports PrivateLink
  • Create a VPC interface endpoint and keep your existing ACME client setup
  • Auditable via CloudTrail and CloudWatch, available in all commercial Regions (PrivateLink charges apply)

This one is for infrastructure folks who want automated certificate renewal on private networks!

Related posts