# ACM now speaks ACME: hands-off public TLS certificates!

Hey, it's Shiichan! Today I found a certificate update that looks small but makes day-to-day operations so much easier, so let me share it.

## What was announced?

Over on AWS What's New, AWS Certificate Manager (ACM) announced support for the ACME protocol. You can now provision a fully managed ACME server endpoint right inside ACM.

With any ACMEv2-compatible client like Certbot, cert-manager for Kubernetes, or acme.sh, you can issue public TLS certificates. The certificates come from [Amazon Trust Services](https://www.amazontrust.com/repository) with a 45-day validity.

## Why it matters

Certificate lifetimes keep getting shorter. The CA/Browser Forum has decided to bring certificate lifetimes down to 47 days by 2029, and at that point managing them by hand just isn't realistic anymore. ACME support gives you a standards-based path to fully automate everything from issuance to renewal, and that's the big deal here.

## What changes

PKI administrators can create ACME endpoints with governance built in. For example, you can:

- Define domain scopes to restrict which certificates each client can issue
- Enforce policies on wildcard usage
- Delegate certificate requests to application teams without handing out DNS credentials

Domain validation happens once at the endpoint level, and the application owners just use standard ACME clients. Not having to pass credentials around is the part I really like.

## Dive Deep

Issued certificates and activity are visible in the ACM console, and you get AWS CloudTrail logging plus Amazon CloudWatch metrics for auditability. So even when a whole team uses it, you can trace who issued what and when.

It's available in all commercial AWS Regions, and for pricing you can check the [ACM pricing page](https://aws.amazon.com/certificate-manager/pricing/).

For more on how to use it, there's the [AWS News blog post](https://aws.amazon.com/blogs/aws/automate-public-tls-certificate-issuance-with-acme-support-in-aws-certificate-manager/) and the [documentation](https://docs.aws.amazon.com/acm/latest/userguide/acm-acme.html).

## Wrap-up

- ACM now supports fully managed ACME endpoints, so you can auto-issue public TLS certificates from clients like Certbot, cert-manager, and acme.sh
- Certificates are issued by Amazon Trust Services with a 45-day validity, and renewal can be automated
- Domain scopes, wildcard policies, and request delegation keep governance tight
- Activity is traceable via CloudTrail and CloudWatch, and it works in all commercial AWS Regions

If you're on the infra or SRE side and want to automate certificate operations ahead of the short-lived-certificate era, this is a great move for you!