Free HTTPS with ACM
AWS Certificate Manager issues free TLS certificates so your site loads over HTTPS.
Modern sites must use HTTPS. AWS Certificate Manager (ACM) issues and auto-renews TLS certificates for free, and integrates directly with CloudFront and load balancers.
How it works
- Request a certificate for your domain (for example
www.example.com). - Prove you own the domain by adding a DNS validation record (Route 53 can do this automatically).
- Attach the issued certificate to your CloudFront distribution.
The one region rule
Certificates used by CloudFront must be requested in the us-east-1 region, no matter where your users are. Certificates for a regional load balancer live in that load balancer's region.
Example
# Request a DNS-validated certificate (must be us-east-1 for CloudFront)
aws acm request-certificate \
--domain-name www.example.com \
--subject-alternative-names example.com \
--validation-method DNS \
--region us-east-1
# AWS returns a CNAME record you add to Route 53 to prove ownershipWhen to use it
- A developer issues a free ACM certificate for their domain so their CloudFront site loads over HTTPS without paying a CA.
- An operations team uses ACM to automatically renew TLS certificates so they never expire and cause downtime.
- A company secures an Application Load Balancer with an ACM certificate for their multi-region production API.
More examples
Request a public ACM certificate
Requests a wildcard TLS certificate valid for the root domain and all subdomains via DNS validation.
# Request must be in us-east-1 for CloudFront use
aws acm request-certificate \
--domain-name example.com \
--subject-alternative-names '*.example.com' \
--validation-method DNS \
--region us-east-1Check certificate validation status
Retrieves the certificate status and the DNS CNAME record you must create to prove domain ownership.
aws acm describe-certificate \
--certificate-arn arn:aws:acm:us-east-1:123456789012:certificate/abc-123 \
--region us-east-1 \
--query 'Certificate.[Status,DomainValidationOptions[0].ResourceRecord]'Attach ACM cert to CloudFront
Updates a CloudFront distribution to use the ACM certificate, enabling HTTPS for the custom domain.
aws cloudfront update-distribution \
--id E1EXAMPLE \
--distribution-config file://dist-config.json
# dist-config.json must include:
# "ViewerCertificate": {
# "ACMCertificateArn": "arn:aws:acm:us-east-1:...:certificate/abc",
# "SSLSupportMethod": "sni-only",
# "MinimumProtocolVersion": "TLSv1.2_2021"
# }
Discussion