11.3 Encryption in Transit with AWS Certificate Manager (ACM)

AWS Certified CloudOps Engineer – Associate SOA-C03

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Monitoring & Observability Infrastructure

1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms

2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation

2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda

3 Chapter 3: Performance Optimization for Compute, Storage & Databases

3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance

4 Chapter 4: Compute & Database Scalability and Elasticity

4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB

5 Chapter 5: High Availability, Fault Tolerance & Load Balancing

5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments

6 Chapter 6: Backup, Data Protection & Disaster Recovery

6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience

7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK

7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures

8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC

8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows

9 Chapter 9: Systems Manager & Event-Driven Operations Automation

9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation

10 Chapter 10: Identity, Access Management & Governance

10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs

11 Chapter 11: Data Security, Encryption & Vulnerability Management

11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings

12 Chapter 12: VPC Architecture, Endpoints & Network Protection

12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing

13 Chapter 13: DNS, Route 53 Routing & Content Delivery

13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator

14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity

14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting

11.3 Encryption in Transit with AWS Certificate Manager (ACM)

Key Takeaways Explain This Topic AI

AWS Certificate Manager (ACM) automates the provisioning, deployment, and renewal of public and private SSL/TLS certificates for AWS-integrated services including Application Load Balancers, Network Load Balancers, CloudFront, and API Gateway.

Public ACM certificates are provided at zero monetary cost, but their private keys are managed within AWS secure enclaves and cannot be downloaded or installed directly on EC2 instances or on-premises servers.

DNS validation enables automatic certificate renewal 60 days before expiration as long as CNAME records persist, whereas email validation requires manual interaction for initial issuance and annual renewal, introducing expiration risk.

AWS Private Certificate Authority (AWS Private CA) provides managed enterprise PKI for internal microservices, containers, and IoT devices, supporting private key export for on-premises and EC2 deployments.

Application Load Balancers enforce encryption in transit by upgrading HTTP (port 80) requests to HTTPS (port 443) via HTTP 301 redirects and applying modern TLS security policies that disable insecure protocols and ciphers.

Last updated: October 2026

11.3 Encryption in Transit with AWS Certificate Manager (ACM)

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to protect network communications across AWS infrastructure. You must master AWS Certificate Manager (ACM) certificate lifecycles, configure automated DNS validation and renewal workflows, establish expiration monitoring using CloudWatch and AWS Config, deploy private PKI using AWS Private CA, and enforce modern TLS security policies and HTTP-to-HTTPS redirects on Application Load Balancers.

AWS Certificate Manager (ACM) Architecture & Integrated Services

Protecting data in transit across public and private networks requires Transport Layer Security (TLS/SSL). AWS Certificate Manager (ACM) simplifies the complex, error-prone operational lifecycle of SSL/TLS certificates by automating certificate provisioning, validation, deployment, and renewal.

Native Integrated AWS Services

Public ACM certificates bind directly to AWS network termination endpoints:

Elastic Load Balancing: Application Load Balancers (ALB) and Network Load Balancers (NLB with TLS listeners).

Amazon CloudFront Distributions: Global content delivery network distributions. Exam Critical: CloudFront is a global edge service; all ACM certificates used by CloudFront must be requested or imported strictly in the us-east-1 (N. Virginia) Region.

Amazon API Gateway: Custom domain names for Regional and Edge-optimized REST and HTTP APIs.

AWS Elastic Beanstalk & AWS App Runner: Managed web application hosting environments.

The Non-Exportable Private Key Security Constraint

For a standard public ACM certificate, the private key cannot be exported or downloaded ; ACM keeps it within its own boundary. Consequently, you cannot use a standard public ACM certificate directly on a bare Amazon EC2 instance running Nginx or Apache, nor can you export it to an on-premises physical server. Standard public ACM certificates terminate on an integrated AWS managed service (such as an ALB or CloudFront), which handles TLS termination and forwards decrypted traffic to backend compute instances over private VPC subnets. The exception is an ACM exportable public certificate (an additional charge), which you can deploy on EC2 instances, containers and on-premises hosts; ACM renews it, but you manage deploying each renewed certificate.

Certificate Validation Mechanisms: DNS vs. Email Validation

Before ACM issues a public certificate, the applicant must prove ownership of the requested domain name. ACM provides two validation mechanisms with starkly different operational characteristics:

Operational Dimension DNS Validation (AWS Recommended) Email Validation

Validation Mechanism Add a unique CNAME record provided by ACM to the domain's public DNS hosted zone. ACM sends approval emails to domain contacts listed in WHOIS and 5 standard administrative inboxes.

Route 53 Integration One-click automatic insertion of CNAME records if Route 53 is in the same AWS account. Manual; requires human operator to open email and click validation link.

Annual Renewal Workflow Fully automated and indefinite. ACM checks DNS continuously; renews 60 days before expiry. Manual human action required. ACM resends approval emails 45 days before expiry.

Operational Risk Profile Near zero. As long as CNAME persists and certificate is in use, it never expires unexpectedly. High risk. Spam filters, employee turnover, or unmonitored mailboxes lead to unexpected outages.

DNS Validation Mechanics

When you request a certificate using DNS validation, ACM generates a unique, domain-specific CNAME record containing an MD5/SHA-256 hash:

Name: _a79865eb4b9f365.example.com.

Value: _x2.acm-validations.aws.

Once added to the DNS zone, ACM queries public DNS servers. Upon verification, the certificate state transitions from Pending validation to Issued . Crucially, DNS validation handles renewals forever . As long as the CNAME record remains in place and the certificate remains actively bound to an AWS resource, ACM automatically issues and deploys renewed certificates 60 days prior to expiration with zero human intervention.

Certificate Expiration Monitoring & Observability

While DNS-validated ACM certificates renew automatically, operational blind spots can still cause production failures (e.g., if a developer deletes a CNAME record, an imported third-party certificate nears expiry, or a certificate is unused and thus excluded from auto-renewal). CloudOps teams establish proactive observability using two AWS monitoring mechanisms:

1. Amazon CloudWatch Metric: DaysToExpiry

ACM publishes the metric DaysToExpiry in the AWS/CertificateManager namespace for each active certificate:

CloudOps engineers configure a CloudWatch Alarm triggered when DaysToExpiry <= 30 (Warning) or DaysToExpiry <= 14 (Critical).

The alarm notifies an Amazon SNS topic linked to the on-call PagerDuty or Slack engineering channel, prompting immediate investigation.

2. AWS Config Managed Rule: acm-certificate-expiration-check

For centralized multi-account governance, AWS Config provides a pre-built managed rule:

Rule Identifier: acm-certificate-expiration-check

Parameters: daysToExpiration (e.g., set to 14 or 30 ).

When AWS Config detects an ACM certificate expiring within the designated threshold, it marks the resource as NON_COMPLIANT and emits a compliance state-change event to Amazon EventBridge , triggering automated ticket creation or executive alerting.

AWS Private Certificate Authority (AWS Private CA)

Public SSL/TLS certificates cannot be issued for internal domains (e.g., api.internal.corp ), and standard public ACM certificates cannot be exported to internal compute resources. For enterprise internal security, AWS provides AWS Private Certificate Authority (AWS Private CA) :

Managed Enterprise PKI: Allows organizations to create a complete private CA hierarchy (Root CA and Subordinate/Issuing CAs) without operating complex on-premises OpenSSL or Microsoft CA infrastructure.

Internal Microservices & mTLS: Issues internal certificates for service-to-service mutual TLS (mTLS) in Amazon EKS, ECS, and service meshes (for example Istio).

Exportable Private Keys: Unlike standard public ACM certificates, private certificates issued by AWS Private CA can have their private keys and certificates exported via the AWS CLI or API ( acm:ExportCertificate ), allowing secure installation directly onto backend EC2 instances, on-premises virtual machines, and IoT microcontrollers.

Enforcing In-Transit Security: ALB Policies & HTTP Redirection

Terminating TLS on an Application Load Balancer requires strict operational hygiene to eliminate deprecated cryptographic standards and ensure all traffic is encrypted.

Enforcing TLS Security Policies

ALB HTTPS listeners use predefined TLS Security Policies that define supported TLS protocol versions and cryptographic cipher suites. Legacy policies often permit insecure protocols (TLS 1.0, TLS 1.1) and vulnerable CBC-mode ciphers susceptible to exploits like POODLE and BEAST.

Security Policy Minimum TLS Version Supported Protocols Operational Compliance Target

ELBSecurityPolicy-TLS13-1-2-2021-06 TLS 1.2 TLS 1.2, TLS 1.3 Modern Best Practice. Disables TLS 1.0/1.1; supports PFS ciphers.

ELBSecurityPolicy-FS-1-2-Res-2020-10 TLS 1.2 TLS 1.2 High security; enforces Forward Secrecy (FS) ciphers only.

ELBSecurityPolicy-2016-08 TLS 1.0 TLS 1.0, 1.1, 1.2 Legacy Default. Insecure; permits outdated ciphers; fails PCI/HIPAA audits.

CloudOps engineers must replace default policies with modern policies like ELBSecurityPolicy-TLS13-1-2-2021-06 on all production HTTPS listeners.

HTTP to HTTPS Listener Redirection

To prevent users from inadvertently transmitting plaintext data, ALBs natively support HTTP-to-HTTPS Redirection at the listener level without requiring backend web server rewrites: {

• "Type": "redirect",
• "RedirectConfig": {
• "Protocol": "HTTPS",
• "Port": "443",
• "Host": "#{host}",
• "Path": "/#{path}",
• "Query": "#{query}",
• "StatusCode": "HTTP_301"
• }
• }

Configuring this redirect rule on the port 80 (HTTP) listener causes the ALB to return an immediate HTTP 301 Moved Permanently response, seamlessly upgrading client browsers to encrypted port 443 sessions.