hidekazu-konishi.com

How AWS Certificate Manager Issues Public Certificates - Managed, Exportable, and ACME: Where the Private Key Lives, Who Renews, Where It Can Be Attached, and What Gets Recorded

First Published: 2026-10-12
Last Updated: 2026-10-12

AWS Certificate Manager (ACM) offers several methods for obtaining public certificates, which have expanded between 2025 and 2026. On June 17, 2025, ACM introduced the ability to export public certificates along with their associated private keys. On July 6, 2026, ACM announced support for issuing public certificates using the ACME protocol. Both kinds of certificates differ from the existing ACM public certificates in who holds the private key and in who deploys the renewed certificate. The "ACME certificate automation" page of the ACM user guide describes the private key for certificates issued through ACME as follows:

Private key: The private key is generated and held by the ACME client. ACM never sees the private key.

The same page also states that certificates issued through ACME cannot be attached to integrated services such as Elastic Load Balancing, CloudFront, and API Gateway. Regarding public certificates requested with RequestCertificate, the user guide's "AWS Certificate Manager public certificates" page details the validity period and renewal process as follows:

Expiration: Each certificate is valid for 198 days.
Renewal: ACM attempts to renew a public certificate automatically 45 days before expiration.

This article maps three paths for getting a public certificate from ACM, one row at a time, against six aspects. The three paths are managed, exportable, and ACME. This division is the article's own and does not match the classifications in AWS documentation (Sections 2.1 and 2.2). The six aspects are where the private key lives, renewal, where the certificate can be attached, revocation and deletion, how the certificate shows up in listing and search, and what gets recorded. For each aspect, the article outlines who is responsible, what the user configures, and where this information can be verified, providing supporting documentation. It also lists where the sources disagree and where no statement was found after searching. The supporting documentation includes the ACM user guide, API reference, AWS CLI reference, ACM FAQ, What's New, and AWS blogs, as verified on October 12, 2026 (Section 1.3). This article does not directly call ACM APIs or issue certificates, nor does it recommend a particular path.

Related articles on this site:

• Moving AWS Certificate Manager Off Email Validation - The Announced Dates, What UpdateCertificateOptions Changes and Keeps, Finding Email-Validated Certificates, and Where the Documentation Has Not Caught Up
• When Public Certificates Stop Carrying clientAuth - Where AWS Sends or Accepts Client Certificates, and What Each Path Says About Extended Key Usage
• AWS Private CA Hierarchy Design - Root and Subordinate CAs, Revocation, Short-Lived Mode, and mTLS on ALB
• TLS Certificate Ecosystem History and Timeline - Certificate Authorities, Automation, and Shrinking Certificate Lifetimes
• Certificate Distribution in Kubernetes with AWS Private CA - Issue, Request, Store, Consume, and the Layer Where Renewal Stops
• Indie Dev Guide: From Domain Acquisition to Live Site with AWS Route 53, S3, CloudFront, and ACM
• Where the Logs Come From on AWS - Identity and the Control Plane, What Is On by Default, and What Is Not Recorded at All
• Centralized Logging and Audit Architecture on AWS - Multi-Account Log Aggregation, Detection, and Query with CloudTrail, Config, Security Hub, and OpenSearch
• AWS Elastic Load Balancing Decision Guide - Choosing and Operating Application, Network, and Gateway Load Balancers
• Cryptography Glossary for Engineers - AES, RSA, ECDSA, HKDF, Envelope Encryption, and TLS Explained

Table of Contents

1. 1. More Ways to Get a Public Certificate from ACM — Scope and Verification Date
2. 2. How to Read the Tables — Who Handles It, What You Configure, and How You Can Check It
3. 3. Where the Private Key Lives
4. 4. Who Renews the Certificate, and When
5. 5. Where the Certificate Can Be Attached
6. 6. Revoking and Deleting Certificates
7. 7. How Certificates Show Up in Listing and Search
8. 8. What Gets Recorded — CloudTrail, Metrics, and the Console
9. 9. The Contract of an ACM ACME Endpoint
10. 10. Where the Sources Disagree and Where No Statement Was Found
11. 11. Frequently Asked Questions about How ACM Issues Public Certificates
12. 12. Summary
13. 13. References

1. More Ways to Get a Public Certificate from ACM — Scope and Verification Date

This section outlines what was added between 2025 and 2026 to the ways to get ACM public certificates, presented in chronological order by announcement date. It then defines the scope of this article, the dates of verification, the materials consulted, and the terminology used throughout this article.

1.1 New Additions from 2025 to 2026

Between June 2025 and October 12, 2026, nine announcements from "What's New" are covered in this article. Eight of these announcements pertain to ACM, while one relates to the AWS Workload Credentials Provider. The following table lists these nine announcements, ordered by their postDateTime (the date and time of the announcement).

Date	What Was Added	Where the Source Says So
2025-06-17	Public certificates that can be exported are now available. You mark a certificate as exportable when you request it. Public certificates issued before this date cannot be exported.	What's New 2025-06-17
2025-08-15	The ACM API can now be accessed via AWS PrivateLink.	What's New 2025-08-15
2025-12-15	With AWS Controllers for Kubernetes (ACK), ACM certificates can now be distributed to Kubernetes Secrets. The ACK controller exports exportable public certificates and rewrites the Secret each time the certificate is renewed.	What's New 2025-12-15
2026-02-18	The validity period for public certificates has been set to 198 days. Renewals are performed 45 days before expiration.	What's New 2026-02-18
2026-04-07	Certificate search functionality is now available, including the SearchCertificates API and the console search bar. The announcement URL references March 2026.	What's New 2026-04-07
2026-06-11	AWS Workload Credentials Provider is now available. This client-side provider automates the deployment of exported ACM certificates.	What's New 2026-06-11
2026-07-06	Public certificate issuance via the ACME protocol is now supported. Users can create endpoints for the ACME servers managed by ACM.	What's New 2026-07-06
2026-08-13	You can switch the domain validation method of an existing certificate from email to DNS.	What's New 2026-08-13
2026-10-06	Issuance through ACME can now be performed over AWS PrivateLink.	What's New 2026-10-06

The change on August 13, 2026, concerns the transition of domain validation methods and is not the subject of this article. A companion article, Moving AWS Certificate Manager Off Email Validation, covers this migration. This article gives only a short note on the validation method of each path (Section 4.6).

The document history in the user guide also contains entries related to this article. The entry dated February 18, 2026, states that the validity period for public certificates was shortened from 395 days to 198 days. The entry dated June 1, 2026, indicates that the option to opt out of certificate transparency (CT) logging is no longer available. The entry dated June 18, 2026, mentions the addition of ACME certificate automation. The entry dated September 28, 2026, notes that the values for the condition keys that ACM sets when an ACME client requests or revokes a certificate have been added to the documentation. No entry for the October 6, 2026, announcement of ACME issuance through PrivateLink was found in the Document history as of the verification date.

1.2 What This Article Covers, and What It Does Not

This article covers three paths for getting an ACM public certificate. For each path, it describes the following six aspects:

• Where the private key lives: Who generates the private key and where is it stored (Section 3).
• Renewal: Who renews the certificate, when, and who deploys the renewed certificate (Section 4).
• Where the certificate can be attached: Which AWS services the certificate can be used with, and whether it can be used outside of AWS (Section 5).
• Revocation and deletion: How the certificate is revoked and how it is deleted (Section 6).
• Listing and search: Whether the certificate appears in the default results of ListCertificates and SearchCertificates (Section 7).
• What gets recorded: Which CloudTrail events record the operation, and what is visible in CloudWatch metrics and the console (Section 8).

In addition, this article will cover the configuration of the ACME endpoint used to issue ACME certificates (Section 9), as well as where the sources disagree and where no statement was found (Section 10).

The following topics are covered in separate articles on this website. These will be mentioned only briefly, each with a short description and a link.

• Private Certificates and AWS Private CA: AWS Private CA Hierarchy Design addresses both certificate issuance paths: using ACM's RequestCertificate and AWS Private CA's IssueCertificate. ACM's ACME does not issue certificates from AWS Private CA. That article also states this boundary. This article covers public certificates only.
• Industry Timelines and the History of ACME: TLS Certificate Ecosystem History and Timeline covers the CA/Browser Forum's schedule for shortening certificate validity periods, as well as the history of the ACME protocol. This article will only document ACM's 198-day validity period and the 45-day validity period for certificates issued through ACME, as described in ACM's documentation.
• Private Certificates within Kubernetes: Certificate Distribution in Kubernetes with AWS Private CA discusses cert-manager and AWS Private CA. If cert-manager is directed to ACM's ACME endpoint, this is in the scope of this article, which focuses on public certificates. However, this article does not cover ACME client configuration.
• Steps to Obtain ACM Certificates with DNS Validation for Personal Websites: Indie Dev Guide covers this topic.
• General Overview of CloudTrail Management and Data Events: Where the Logs Come From on AWS and Centralized Logging and Audit Architecture on AWS address this. This article will only describe which type of event (management or data) ACM operations generate.
• Transition of Domain Validation Methods and Extended Key Usage for Certificates: Two companion articles, Moving AWS Certificate Manager Off Email Validation and When Public Certificates Stop Carrying clientAuth, cover this.

Imported certificates are addressed only as one of the certificate types in the classification tables of Section 2.2. This article does not cover the design of the services that utilize the certificates (such as load balancers or CloudFront). It does not discuss which path to choose.

1.3 The Verification Date and the Sources Read

This article's information was verified on October 12, 2026 (Japan Standard Time). The materials consulted are as follows:

• ACM User Guide: Pages on ACME (ACME certificate automation, ACME endpoints, ACME domain validation, External account bindings, Issuing certificates through ACME, Issuing ACME certificates over AWS PrivateLink, Troubleshoot ACME certificate automation, Condition keys for ACME certificate requests), Public Certificates (AWS Certificate Manager public certificates, Request a public certificate in AWS Certificate Manager, AWS Certificate Manager exportable public certificates, Export an AWS Certificate Manager public certificate, Revoke an AWS Certificate Manager public certificate, Force certificate renewal), Management and Renewal (Managed certificate renewal in AWS Certificate Manager, Renewal for domains validated by DNS, Search certificates managed by AWS Certificate Manager, Delete certificates managed by AWS Certificate Manager), Types of certificates in AWS Certificate Manager, Choosing how to issue certificates with AWS, Managed automation with integrated services, Data protection in AWS Certificate Manager, Use condition keys with ACM, ACM API actions supported in CloudTrail logging, Supported CloudWatch metrics, Amazon EventBridge support for ACM, Quotas, Document history.
• ACM API Reference: RequestCertificate, ExportCertificate, RevokeCertificate, RenewCertificate, DeleteCertificate, ListCertificates, SearchCertificates, DescribeCertificate, UpdateCertificateOptions, PutAccountConfiguration, DeleteAcmeEndpoint, RevokeAcmeAccount, and data types: CertificateDetail, CertificateSummary, CertificateOptions, Filters, AcmCertificateMetadata, AcmCertificateMetadataFilter, AcmeEndpoint.
• AWS CLI Reference: list-certificates, search-certificates, describe-certificate, export-certificate, revoke-certificate.
• FAQ and Announcements: ACM FAQ. Nine items under "What's New" in Section 1.1. Two items from the AWS News Blog (exportable certificates on 2025-06-17, ACME on 2026-06-30) and three items from the AWS Security Blog (exportable certificates on 2025-06-30, ACME on 2026-08-06, end of email validation on 2026-08-13).

The user guide and API reference do not have version numbers. This article reflects the information as of the date of verification. The "What's New" date refers to the date of the announcement (postDateTime), and the blog date indicates the page's publication date. This article does not call the ACM API. It does not issue certificates or create ACME endpoints. The response format is based on examples from the API reference and user guide.

1.4 Words with the Same Spelling, Different Meanings

This article deals with words that share the same spelling or number but refer to different things. This article distinguishes them as follows:

• 45 Days: There are three distinct periods. The first is the 45-day validity period of certificates issued through ACME. The second is the 45 days before the certificate's expiration, when ACM attempts to renew the public certificate. The third is the 45 days before expiration, when ACM begins sending expiration events for private and imported certificates (as described in the user guide; for the disagreement with the API reference, see Section 4.5). This article will consistently specify whether it refers to the certificate's validity period, the number of days before expiration, or the type of event.

• ACME and ACM: ACME is a protocol for automating certificate issuance (RFC 8555). ACM is AWS Certificate Manager. ACM provides the server for ACME, and ACME clients request certificates from that server. The CertificateKeyPairOrigin value of ACME indicates certificates issued through ACME.

• Managed: In this article, "managed" refers to public certificates requested with RequestCertificate without enabling export. AWS documentation may use "managed" to refer to different concepts, such as managed renewal (renewal performed by ACM), managed ACME server (an ACME server managed by ACM), or managed automation with integrated services.

• Export: There are three things related to export. First, it's the Export option (either ENABLED or DISABLED) when requesting a certificate. Second, it's the ExportCertificate operation used to retrieve the certificate. Third, it's the Exported field, which indicates whether the certificate has been exported. In this article, "exportable certificates" are certificates with the Export option set to ENABLED. Of those, the certificates that have actually been retrieved are called "exported" certificates.

• Revocation, Expiration, and Deletion: Revocation involves instructing the Certificate Authority (CA) to invalidate the certificate. Expiration occurs when the certificate's validity period has ended. Deletion refers to removing the certificate resource from your ACM account. These are three separate actions.

• RevokeCertificate and GetCertificate: Both are names associated with two different entities. One is an operation in the ACM API. The other is the name of an event that is logged in CloudTrail when an ACME operation occurs (Section 8.3).

• Renewal: ACM's renewal process (managed renewal) and the renewal performed by an ACME client are distinct. For exportable certificates, after ACM renews the certificate, the user deploys the renewed certificate. This article differentiates between renewal and deployment.

2. How to Read the Tables — Who Handles It, What You Configure, and How You Can Check It

This section defines the three paths used in this article and establishes the columns and terms used in the tables. The tables in Sections 3 through 8 all share the same columns, detailing who is responsible, what settings users can configure, where these settings can be verified, and the source documents that provide the basis for this information.

2.1 The Three Paths as Defined in This Article

This article divides the ways to get an ACM public certificate into the following three paths:

• Managed (Managed): Public certificates that are requested with RequestCertificate without setting the Export option in Options to ENABLED. ACM generates and stores the private key. Users cannot retrieve the private key.
• Exportable (Exportable): Public certificates that are requested with RequestCertificate with the Export option in Options set to ENABLED. ACM generates and stores the private key. Users can retrieve the private key using the ExportCertificate operation.
• ACME (ACME): Public certificates that an ACME client receives from an ACM ACME endpoint. The ACME client generates and stores the private key.

Managed and Exportable certificates are both requested using the same RequestCertificate operation. The difference lies in the value of the Export option. The CertificateOptions API reference states that this value cannot be changed after the certificate is created. Conversely, the UpdateCertificateOptions API reference states that this operation allows you to specify whether the certificate should be exportable. The sources disagree (see Section 10.1).

These three paths are defined in this article. No classification in AWS documentation that divides certificates into these three was found (see Section 2.2). This article differentiates based on who holds the private key and how the certificate is obtained. ACM private certificates and certificates imported into ACM do not fall within these three paths.

2.2 How Each Source Classifies Certificates

ACM's sources divide certificates into a different number of types in each source. The following table shows how each source divided certificates as of the verification date.

Source	How It Divides Certificates	Where the 3 Paths Fall
User guide: Types of certificates in AWS Certificate Manager	3 types: Public certificates, Private certificates, and Imported certificates.	All three paths fall under Public certificates. This page does not list exportable certificates or ACME as types.
User guide: Choosing how to issue certificates with AWS	3 columns: ACM, ACM with ACME, and AWS Private CA (direct issuance).	Managed and exportable certificates fall under the ACM column. The row regarding private keys within the ACM column indicates that they can be exported. ACME falls under the ACM with ACME column.
ACM FAQ - What types of certificates can I manage with ACM?	4 types: Public certificates, Exportable public certificates, Private certificates, and Imported certificates.	Managed certificates fall under Public certificates, while exportable certificates fall under Exportable public certificates. ACME is not listed.
ACM FAQ - What types of certificates does ACM manage?	3 types: public, private, and imported.	All three paths can be read as falling under public. ACME is not listed.
API - CertificateKeyPairOrigin	3 values: AWS_MANAGED, ACME, and CUSTOMER_PROVIDED.	ACME is represented by ACME. The field values for managed and exportable certificates are described in Section 2.9.
API - Type	3 values: AMAZON_ISSUED, IMPORTED, and PRIVATE.	Certificates provided by ACM are represented by AMAZON_ISSUED. The value for certificates issued through ACME was not found in the sources as of the verification date.
API - ExportOption (within CertificateSummary) and Options.Export (within CertificateDetail)	2 values: ENABLED and DISABLED.	Exportable certificates are represented by ENABLED.

The same FAQ page lists four types in one question and three types in another. As of the verification date, the FAQ page does not contain the word ACME at all (see Section 10.1).

2.3 Common Columns

The tables in Sections 3 through 8 share five common columns. These five columns are used consistently across this article and its two companion articles.

• Aspect: The item of the contract. This article uses six aspects consistently across Sections 3 through 8: Private key location, Renewal, Where it can be attached, Revocation and deletion, Listing and search, and What gets recorded. Section 9.8 lists six aspects as items for the ACME endpoint: Domain approval, Account registration, Issuance and revocation authorization, Key algorithms, Certificate tags, and Network path.
• Handled By: Indicates who is responsible for this item (see Section 2.4).
• What You Configure: Specifies what the user configures or the action they invoke. This includes operation names, parameter names, and configuration names. If no setting for the user is found in the sources, write Nothing.
• How You Can Check It: Describes the type of location where the user can verify this item, along with the specific name (see Section 2.5).
• Where the Source Says So: Refers to the source document that supports this row. This could be a page title or an API operation name. A summary of the description is provided either in the cell or in the sentence following the table.

2.4 Handled By Values

The Handled By column should contain one of the following five options:

• ACM: Handled by ACM.
• You: Handled by the user.
• Your ACME client: Handled by the user's ACME client.
• The certificate authority: Handled by the certificate authority.
• The source does not say.: The documentation does not specify who is responsible.

If a single cell requires multiple values, specify each role in parentheses. For example, ACM (renews), You (deploys) indicates that ACM is responsible for renewal and the user is responsible for deployment. This article will only use ACM, You, and Your ACME client. The certificate authority and The source does not say. will not be used.

The companion articles may add additional values to these five. These added values will be defined within those articles, the first time they are used. These added values do not alter the meaning of the original five options.

2.5 How You Can Check It Types

The How You Can Check It column begins with one of the following types, followed by a specific name.

• API field: Found in the fields of an API response. Includes the operation name and field name.
• API operation: Found as a result of calling an API operation. Includes the operation name.
• Console: Found in the AWS Management Console.
• CloudTrail management event: Found in CloudTrail management events. Management events are recorded by default.
• CloudTrail data event: Found in CloudTrail data events. Data events are not recorded by default.
• CloudWatch metric: Found in CloudWatch metrics.
• EventBridge event: Found in Amazon EventBridge events.
• Documentation only: The information was found only in the documentation; a location to verify it could not be found.
• Not found: No location or description could be found in the consulted materials.

Documentation only and Not found do not mean that there is no way to verify the information. The materials and search terms used are listed in Section 10.2.

2.6 How Dates and Verification Dates Are Written

What's New entries should display the date from the announcement's postDateTime. In the table, the date follows the What's New entry. For blog posts, the date should follow the blog name, indicating the publication date of the page. User guide entries should be identified by the page title. API reference entries should be identified by either the operation name or the data type name. The dates in the Document history should reflect the date of each respective entry. The statements in the user guide, API reference, and FAQ were all checked on October 12, 2026.

2.7 When the Source Does Not Say, and When Sources Disagree

Table cells contain only what the source says, or a summary of it. If the source does not say, write The source does not say. Before writing this, this article searches the full text of the source the row cites, the pages that source links to, and other pages from the same provider. These other pages include API references, CLI references, FAQs, What's New posts, Document history, and blogs. The searches use the subject of the row, along with the terms ACME, export, revoke, renew, delete, and default. If the source only describes general principles and does not specifically address the subject of the row, do not write The source does not say. Instead, write the general rule and the fact that the row's subject is not named.

When sources disagree, list both descriptions with their respective sources, without favoring either one. The disagreements in this article are summarized in Section 10.1. Typos and symbols in the original text are kept as published in the quotations. Typos are not marked inside the quotations.

2.8 Columns Unique to This Article — Path

The tables presented in Sections 3 through 8, for each item, feature a Path column instead of the Aspect column, as described in Section 2.3. The values for Path are Managed, Exportable, and ACME, and these represent the three paths defined in Section 2.1. Each table is preceded by a sentence indicating which item (or Aspect) the table refers to. Only the overview table in Section 2.10 presents Aspect as rows and the three paths as columns.

2.9 Fields That Tell Which Path Your Certificate Came From

Users can identify how their certificate was created through fields in the API. The following three fields were found in the documentation reviewed:

• CertificateKeyPairOrigin: Indicates the origin of the certificate's key pair. Possible values are AWS_MANAGED, ACME, and CUSTOMER_PROVIDED. This field is present in the response from DescribeCertificate (CertificateDetail), ListCertificates (CertificateSummary), and SearchCertificates (AcmCertificateMetadata).
• ExportOption and Options.Export: Indicates whether the certificate can be exported. Possible values are ENABLED and DISABLED. The responses from ListCertificates and SearchCertificates include the ExportOption field. The response from DescribeCertificate includes Export in Options (CertificateOptions).
• Exported: Indicates whether the certificate has been exported. Possible values are true or false. This field is present in the responses from ListCertificates (CertificateSummary) and SearchCertificates (AcmCertificateMetadata). As of the verification date, CertificateDetail in the API reference does not have this field.

For certificates issued through ACME, the CertificateKeyPairOrigin is ACME. The ACME certificate automation page of the user guide states that the CertificateKeyPairOrigin will be ACME in the responses from DescribeCertificate, ListCertificates, and SearchCertificates.

Specific descriptions detailing the values of the CertificateKeyPairOrigin fields for managed and exportable certificates were not found in the documentation reviewed. However, there are three clues. The first is the "Use condition keys with ACM" page in the user guide. This page describes the IAM condition key acm:CertificateKeyPairOrigin as follows:

For RequestCertificate, the value is always AWS_MANAGED. When requesting certificates through an ACME client, the value is ACME. For AddTagsToCertificate and RevokeCertificate, the value is read from the existing certificate.

This value is a condition key used when IAM approves a request; the page does not call it a value from a certificate field. The second clue is a response example on the search page of the user guide. This example shows AWS_MANAGED as the CertificateKeyPairOrigin of a certificate whose Type is AMAZON_ISSUED and whose Exported is false. This example does not include an ExportOption. The third clue is the "Managed automation with integrated services" page in the user guide. This page states that when using integrated services, you should use certificates with a CertificateKeyPairOrigin of either AWS_MANAGED or CUSTOMER_PROVIDED. From these three clues, one can read the field value for managed and exportable certificates as AWS_MANAGED. However, this is an inference. This article does not state that the value for managed and exportable certificates is AWS_MANAGED. To tell managed and exportable certificates apart, check ExportOption or Options.Export.

2.10 Overview of the Six Aspects

The following table summarizes the content of Sections 3 through 8, in one table by the six aspects and the three paths. The basis and conditions for each cell are detailed in the tables and text of each section.

Aspect	Managed	Exportable	ACME
Private key location	ACM generates the key and stores it encrypted with the aws/acm KMS key.	ACM generates and stores. Users can retrieve the encrypted private key with ExportCertificate.	The ACME client generates and stores. ACM does not have access to the private key.
Renewal	ACM handles renewal. ACM attempts renewal 45 days before expiration, subject to certain conditions.	ACM handles renewal. The sources describe the renewal conditions differently. Users are responsible for deploying renewed certificates.	The ACME client handles renewal. It is not eligible for ACM's managed renewal service.
Where it can be attached	ACM's integrated services.	ACM's integrated services and outside of AWS.	Cannot be attached to ACM's integrated services. Used within the user's infrastructure where the ACME client operates.
Revocation and deletion	Cannot be revoked via API (user guide). The FAQ states that users can request revocation through a support case. Can be deleted if not in use with integrated services.	Can be revoked using RevokeCertificate if exported. Deletion is the same as for managed certificates.	Revoked through the ACME endpoint's revoke-cert URL. The sources disagree on whether it can be deleted.
Listing and search	Appears in the default results of ListCertificates. However, there is a default filter based on key type.	Same as managed.	Does not appear in the default results of ListCertificates. The sources disagree on the default of SearchCertificates.
What gets recorded	ACM API operations listed on the CloudTrail page are management events.	Same as managed. ExportCertificate is also a management event.	ACME account operations are management events. Order, certificate retrieval, and revocation operations are data events and are not recorded by default.

Figure 1 shows, for the three paths, how you get the certificate, the private key, renewal, and where it can be attached.

3. Where the Private Key Lives

This section details who generates the private key and where it is stored for each of the three paths. The table in Section 3.4 is the table for the Private key location aspect.

3.1 Managed — ACM Generates, Encrypts, and Stores

The "Data protection in AWS Certificate Manager" page of the user guide describes how private keys are handled when a public certificate is requested. ACM generates a public/private key pair and stores both the certificate and the private key. ACM uses AWS KMS to protect the private key. When a certificate is requested or imported for the first time in a particular region, ACM creates an AWS-managed KMS key with the alias aws/acm. This KMS key is unique to each AWS account and region. ACM encrypts the private key using this KMS key. The same page states:

ACM stores only an encrypted version of the private key; ACM does not store the private key in plaintext form.

When a certificate is associated with an integrated service, ACM sends both the certificate and the encrypted private key to that service. Simultaneously, it creates an AWS KMS grant that allows the service to decrypt the private key. The integrated service then uses the decrypted private key to establish TLS sessions. When the certificate is disassociated, this grant is retired. The user guide indicates that users can control the automatically created grant, and that deleting the grant will result in the integrated service losing access to ACM's functionality.

This page describes the process when requesting a public certificate and does not name exportable certificates separately. Users of managed certificates cannot export the private key. The "Request a public certificate in AWS Certificate Manager" page of the user guide states that to export the private key, a new public certificate must be created with the export option enabled.

3.2 Exportable — ACM Stores, You Retrieve

ACM also generates and stores the private key of an exportable certificate. The "Choosing how to issue certificates with AWS" page of the user guide notes that, for ACM, AWS generates and manages the private key, and users can export it for use outside of AWS.

Users can retrieve the certificate and private key with ExportCertificate. The API reference describes the contents and conditions of the exported file as follows:

The exported file contains the certificate, the certificate chain, and the encrypted private key associated with the public key that is embedded in the certificate. For security, you must assign a passphrase for the private key when exporting it.

The certificate that can be exported is subject to a creation date condition. Both the API reference and the user guide state the following:

ACM public certificates created prior to June 17, 2025 cannot be exported.

The exported private key is placed in the user's possession. The "AWS Certificate Manager exportable public certificates" page in the user guide highlights security considerations, emphasizing the need to protect the exported private key with secure storage and access control. It also recommends using ACM's revocation feature if there is any suspicion of key compromise.

The ability to create exportable certificates can be restricted using IAM. The "Use condition keys with ACM" page in the user guide explains that the acm:Export condition key can be used to limit the creation of exportable public certificates.

3.3 ACME — Generated and Stored by the ACME Client

The ACME client generates and stores the private keys of certificates issued through ACME. The "Issuing certificates through ACME" page of the user guide states:

The private key is generated by the ACME client and never leaves the client's system.

The ACME client sends a Certificate Signing Request (CSR) to the ACME endpoint. ACM then issues a certificate based on that CSR. Because ACM does not receive the private key, ACM's ExportCertificate cannot be used. The same page explains the reason as follows:

Cannot export through ACM: The ExportCertificate API cannot be used because the certificate is already exported by definition since the client has it.

The "Condition keys for ACME certificate requests" page of the user guide also describes this same principle. In ACME issuance, the IAM condition key acm:Export is always set to ENABLED.

Always ENABLED. The ACME client generates and holds the private key, so an ACME certificate is exported by definition. A policy that denies issuance when acm:Export is ENABLED therefore denies all ACME issuance.

Therefore, if you attempt to prevent the creation of exportable certificates by rejecting requests with acm:Export set to ENABLED, all ACME issuance is also denied. The key algorithms that ACME issuance can use can be restricted with the ACME endpoint's AllowedKeyAlgorithms (see Section 9.2).

3.4 Private Key Location Table

The following table is the table for the Private key location aspect.

Path	Handled By	What You Configure	How You Can Check It	Where the Source Says So
Managed	ACM	KeyAlgorithm (the key algorithm) of RequestCertificate. The KMS grant created when the certificate is associated with an integrated service.	Documentation only: See the user guide's description of private key protection.	Data protection in AWS Certificate Manager
Exportable	ACM (generates and stores), You (stores the exported copy)	Set Export to ENABLED within the Options section of the RequestCertificate request. Also, configure the Passphrase for ExportCertificate. Use the condition key acm:Export.	API field: Check ExportOption and Exported in the ListCertificates and SearchCertificates API calls.	ExportCertificate, AWS Certificate Manager exportable public certificates, Use condition keys with ACM
ACME	Your ACME client	Key settings of your ACME client. AllowedKeyAlgorithms of the ACME endpoint.	API field: CertificateKeyPairOrigin is ACME in DescribeCertificate and other responses.	ACME certificate automation, Issuing certificates through ACME, Condition keys for ACME certificate requests

4. Who Renews the Certificate, and When

This section details who will renew certificates, when they will be renewed, and who will be responsible for deploying the renewed certificates. It also covers certificates issued with the earlier 395-day validity period, expiration events, and the domain validation method of each path. The table in Section 4.7 is the table for the Renewal aspect.

4.1 Managed — ACM Attempts Renewal 45 Days Before Expiration

The AWS Certificate Manager public certificates page in the user guide states that public certificates have a validity period of 198 days and that ACM automatically attempts renewal 45 days before expiration.

Renewal by ACM is subject to certain conditions. The "Managed certificate renewal in AWS Certificate Manager" page in the user guide lists the conditions under which automatic renewal is possible. There are two conditions related to public certificates:

ELIGIBLE if associated with another AWS service, such as Elastic Load Balancing or CloudFront.
ELIGIBLE if exported since being issued or last renewed.

The same page also states that imported certificates and certificates that have already expired are not eligible for automatic renewal. Regarding certificates validated via DNS, the "Renewal for domains validated by DNS" page in the user guide details the conditions ACM checks 45 days before expiration. These conditions are that the certificate is currently in use by an AWS service, and that all DNS CNAME records specified by ACM are publicly available for each Subject Alternative Name (SAN). If both conditions are met, ACM considers the domain validated and proceeds with renewing the certificate. ACM's FAQ also states that public certificates validated via DNS can be automatically renewed as long as they are in use, without requiring any additional action from the user.

ACM is also responsible for replacing the renewed certificate. ACM's FAQ states that for public certificates used in integrated services, ACM manages both the renewal and deployment. In response to a question about whether a notification is sent before renewal and deployment, the same FAQ answers:

No. ACM may renew or rekey the certificate and replace the old one without prior notice.

Even after ACM renews a certificate, the certificate's ARN remains unchanged, according to the "Managed certificate renewal in AWS Certificate Manager" page. If ACM is unable to automatically validate the domain, it sends events to AWS Health and EventBridge. The DNS renewal page specifies the timing of these events as 30 days, 15 days, 7 days, 3 days, and 1 day before expiration.

4.2 Exportable — ACM Renews, You Deploy

ACM also renews exportable certificates. The "AWS Certificate Manager exportable public certificates" page of the user guide lists three limitations:

Certificates have a 198 days validity period.
ACM renews certificates set to expire 45 days before their expiration date.
You must manage the deployment process for exported certificates.

It is the user who deploys the renewed certificate. The same page states that ACM handles renewals and notifies you when new certificates are ready for deployment, providing a link to the Amazon EventBridge support for ACM page for further details. The ACM Certificate Available event on that page indicates that a managed public or private certificate has become available for use, and is triggered during issuance, renewal, and import. The best practices on the exportable certificates page list using renewed certificates immediately and testing and implementing automated deployment of renewed certificates.

The sources describe the renewal conditions for exportable certificates differently. The "Managed certificate renewal in AWS Certificate Manager" page, as referenced in Section 4.1, states that certificates exported after issuance or the previous renewal are eligible for automated renewal. In contrast, the "Renewal for domains validated by DNS" page lists two conditions for renewal: active use within AWS services and the presence of a CNAME record, without mentioning export (Section 10.1).

Regarding automated deployment, AWS has announced two means. The What's New post of December 15, 2025, states that the AWS Controllers for Kubernetes (ACK) controllers export ACM certificates after validation and rewrite Kubernetes Secrets at each renewal. The What's New post of June 11, 2026, and the user guide's "Document history" page describe AWS Workload Credentials Provider as a client-side provider that automates the deployment of exported ACM certificates. This article does not cover these two means.

Users can also force a renewal. The user guide's "Force certificate renewal" page states that RenewCertificate can renew ACM public and private certificates, and limits it to certificates that have been exported. The API reference's description of RenewalEligibility states that only exported private certificates can be renewed using RenewCertificate. The sources disagree (Section 10.1).

4.3 ACME — Your ACME Client Renews

Certificates issued through ACME have a validity period of 45 days. The user guide's page on ACME certificate automation notes that this validity period is shorter than those of other ACM-issued public certificates, and that it is compensated for by automated renewal through ACME clients.

ACM does not renew certificates issued through ACME. The user guide's "Issuing certificates through ACME" page states:

Renewal is client-driven: ACM does not auto-renew ACME certificates. The ACME client must request a new certificate before the existing one expires.

The "Managed certificate renewal in AWS Certificate Manager" page also states that certificates issued through ACME are not eligible for ACM's managed renewal process, and that the ACME client manages renewal. The user guide explains that many ACME clients, including Certbot, can perform automated renewals through scheduled tasks such as cron or systemd timers.

Even when an ACME client renews a certificate, the ARN (Amazon Resource Name) may be preserved. When a certificate is re-issued from the same ACME account with the same metadata (such as domain name and key algorithm), ACM will update the certificate at the existing ARN rather than creating a new one. However, if the original certificate has been deleted, re-issuing with the same metadata will result in a new ARN. The user guide provides an example where the original certificate might be deleted, such as when it is automatically removed after exceeding its expiration date by more than one year.

Issuing certificates through ACME can sometimes take time. The user guide notes that issuing certificates through ACM's ACME endpoint can take up to two minutes, and recommends setting the ACME client's issuance timeout to 120 seconds or longer.

4.4 Certificates Valid for 395 Days

Prior to February 18, 2026, the validity period for ACM's public certificates was 395 days. The "Renewal for domains validated by DNS" page in the user guide states the renewal of those certificates as follows:

Previously issued certificates with a 395-day validity period renew 60 days before expiration and receive a renewed validity period of 198 days. Certificates with a 198-day validity period renew 45 days before expiration.

The What's New post of February 18, 2026, also announced the same change. Within that announcement, there was a combination of statements: one indicating the previous validity period was 395 days, and another stating that existing certificates with a 398-day validity period would be renewed 60 days before their expiration (see Section 10.1). The ACM FAQ, as of the verification date, stated that ACM begins the renewal process up to 60 days before expiration, and specified a validity period of 13 months (395 days). In another question in the same FAQ, the validity period for public certificates was stated to be 198 days (see Section 10.1).

4.5 Expiration Events and the DaysToExpiry Metric

ACM emits both EventBridge events and CloudWatch metrics for certificates nearing their expiration date. The Amazon EventBridge support for ACM page of the user guide states that the ACM Certificate Approaching Expiration event is sent daily for all active certificates (public, private, and imported). For private and imported certificates, this event begins to be sent 45 days before expiration, while for public certificates, it begins 30 days before expiration. This timeframe can be modified using the PutAccountConfiguration API. Examples of this event include values for CertificateKeyPairOrigin such as AWS_MANAGED, ACME, and CUSTOMER_PROVIDED, and also include fields such as AcmeEndpointArn and AcmeAccountId.

The PutAccountConfiguration API reference lists the default settings as:

By default, accounts receive events starting 45 days before certificate expiration.

This text does not differentiate between public and other certificate types. The user guide specifies that public certificates trigger the event 30 days before expiration. The sources disagree (Section 10.1).

The CloudWatch DaysToExpiry metric represents the number of days remaining until a certificate's expiration. The Supported CloudWatch metrics page of the user guide states that ACM publishes this metric twice daily for all certificates.

When user action is required to renew a certificate, the ACM Certificate Renewal Action Required event is triggered. The user guide indicates that this event is sent 45 days before expiration for private certificates and 30 days before expiration for public certificates, when automated renewal fails. The example for this event only includes the value AWS_MANAGED for CertificateKeyPairOrigin.

4.6 Domain Validation Methods by Path

For managed and exportable certificates, you choose the domain validation method when you request the certificate. The ValidationMethod value within RequestCertificate can be one of three options: EMAIL, DNS, or HTTP. The user guide states that when requesting a public certificate, you can choose either DNS or email validation through the console. However, the AWS Security Blog published on August 13, 2026, announced that email validation will be phased out in 2027. A companion article, Moving AWS Certificate Manager Off Email Validation, covers the timeline and migration process. ACME certificates are always validated using DNS. The "Condition keys for ACME certificate requests" page of the user guide notes that for ACME issuance, the condition key acm:ValidationMethod is always set to DNS, and that ACME issuance utilizes DNS validation configured on the endpoint (see Section 9.1).

4.7 Renewal Table

The following table is the table for the Renewal aspect.

Path	Handled By	What You Configure	How You Can Check It	Where the Source Says So
Managed	ACM	Keep the DNS validation CNAME records. Associate the certificate with an integrated service.	API field: RenewalEligibility, RenewalSummary. EventBridge event: ACM Certificate Approaching Expiration, ACM Certificate Renewal Action Required. CloudWatch metric: DaysToExpiry.	AWS Certificate Manager public certificates, Managed certificate renewal in AWS Certificate Manager, Renewal for domains validated by DNS.
Exportable	ACM (renews), You (deploys)	Deploy the renewed certificate. If necessary, call RenewCertificate.	EventBridge event: ACM Certificate Available. API field: Exported.	AWS Certificate Manager exportable public certificates, Amazon EventBridge support for ACM, Force certificate renewal.
ACME	Your ACME client	Configure renewal in your ACME client (scheduled runs, issuance timeout).	CloudWatch metric: CertificateIssuanceSuccess, CertificateIssuanceFailed. EventBridge event: ACM Certificate Approaching Expiration (example with ACME value).	ACME certificate automation, Issuing certificates through ACME, Managed certificate renewal in AWS Certificate Manager.

5. Where the Certificate Can Be Attached

This section details which AWS services certificates can be attached to, depending on the path, and whether they can be used outside of AWS. The table in Section 5.4 is the table for the Where it can be attached aspect.

5.1 Managed — ACM Integrated Services

The user guide refers to AWS services that can directly utilize ACM certificates as "integrated services." The "Managed automation with integrated services" page in the user guide notes that the number of these integrated services continues to grow. As of October 12, 2026, the page lists the following 12 services:

• Elastic Load Balancing
• Amazon CloudFront
• Amazon Elastic Kubernetes Service
• Amazon Cognito
• AWS Elastic Beanstalk
• AWS App Runner
• Amazon API Gateway
• AWS Nitro Enclaves
• AWS CloudFormation
• AWS Amplify
• Amazon OpenSearch Service
• AWS Network Firewall

This list is as of the verification date, and this article does not claim it is exhaustive. Some entries in the list describe integrations that differ from how managed certificates are attached. The entry for Amazon Elastic Kubernetes Service describes an integration that uses AWS Controllers for Kubernetes (ACK) to issue and export certificates, updating Kubernetes Secrets. The entry for AWS Nitro Enclaves states that EC2 instances connected to Nitro Enclaves can utilize ACM certificates.

A note on the same page specifies the origin of the key pair used for certificates within these integrated services:

ACME certificates (certificates with CertificateKeyPairOrigin of ACME) cannot be used with AWS integrated services. To use certificates with the services listed below, use ACM-managed certificates with a key pair origin of AWS_MANAGED or CUSTOMER_PROVIDED.

The ACM FAQ states that for integrated services, ACM manages the renewal and deployment of the public certificates (Section 4.1).

5.2 Exportable — Integrated Services and Beyond AWS

Exportable certificates can be used with integrated services and outside of AWS. The user guide page "Request a public certificate in AWS Certificate Manager" states:

Exportable public certificates work with integrated AWS services and can also be used outside AWS Cloud.

The AWS Certificate Manager user guide page on exportable public certificates lists examples of usage, including Amazon EC2 instances, containers, and on-premises hosts. Deploying certificates outside AWS is up to you (see Section 4.2).

5.3 ACME — Cannot Be Attached to Integrated Services

Certificates issued through ACME cannot be used with integrated services. The ACME certificate automation page of the user guide states:

ACME-issued certificates cannot be bound to Managed automation with integrated services such as Elastic Load Balancing, CloudFront, or API Gateway. Use the certificate on your managed infrastructure where the ACME client holds the private key.

The "Issuing certificates through ACME" page of the user guide lists the reason as AWS not holding the private key. The environment where ACME certificates are used is based on the user's infrastructure, where the ACME client holds the private key. The "Choosing how to issue certificates with AWS" page of the user guide indicates that when using ACME, the certificate is placed within the user's system.

The ACME certificate automation page of the user guide includes a section outlining when to use ACME versus RequestCertificate. This section states that RequestCertificate should be used when certificates are required for integrated services, when you want ACM to manage the private key, or when you want to utilize ACM's managed renewal. ACME should be used when certificates are required for an environment managed by the user, or when it is necessary to keep the private key on the user's own systems, among other cases. This article does not evaluate this guidance; it only shows what the AWS documentation says.

5.4 Table for Where It Can Be Attached

The following table is the table for the Where it can be attached aspect.

Path	Handled By	What You Configure	How You Can Check It	Where the Source Says So
Managed	ACM	Associate the certificate within the integrated services.	API field: Check InUse in ListCertificates and SearchCertificates, and InUseBy in DescribeCertificate.	Managed automation with integrated services
Exportable	ACM (integrated services), You (outside AWS)	Associate with integrated services, or use ExportCertificate and deploy it yourself.	API field: Check InUse and Exported in ListCertificates and SearchCertificates.	Request a public certificate in AWS Certificate Manager, AWS Certificate Manager exportable public certificates
ACME	Your ACME client	Deploy through your ACME client.	Documentation only: Indicates that it cannot be used with integrated services.	ACME certificate automation, Issuing certificates through ACME, Managed automation with integrated services

6. Revoking and Deleting Certificates

This section describes how certificates from each of the three paths are revoked and deleted. Revocation and deletion are different things (see Section 1.4). The table in Section 6.5 is the table for the Revocation and deletion aspect.

6.1 Managed — Certificates Cannot Be Revoked via the API

Managed certificates cannot be revoked through the ACM API. The "Revoke an AWS Certificate Manager public certificate" page in the user guide states (verbatim):

You can only revoke certificates that were previously exported.
You cannot revoke non-exportable public certificates. If you no longer need these certificate, you should delete them instead.

The ACM FAQ answers the question of how to revoke a certificate with the following:

You can request ACM to revoke a public certificate by visiting the AWS Support Center and creating a case. Exportable public certificates can be revoked using the revoke-certificate API.

The first sentence of the FAQ states that for public certificates, users can create a case with the AWS Support Center and request ACM to revoke the certificate. This sentence does not separate exportable certificates from others. This article simply presents the descriptions from the user guide and the FAQ without definitively stating whether managed certificates can be revoked through a support case. The user guide recommends deleting certificates that are no longer needed.

6.2 Exportable — RevokeCertificate If Exported

Exportable certificates can be revoked with RevokeCertificate if they have been exported. The API reference describes this as follows:

Revokes a public ACM certificate. You can only revoke certificates that have been previously exported.

The condition for revocation is that the certificate must have been exported. Even if Export is set to ENABLED, certificates that have not yet been exported do not meet this condition. As quoted in Section 6.1, the ACM FAQ states that exportable public certificates can be revoked with revoke-certificate. The FAQ uses the term "exportable," while the API reference and user guide use the term "previously exported" (Section 10.1).

The revocation page in the user guide states that revocation requires a reason, and lists four reasons that can be used: Unspecified, Affiliation changed, Superseded, and Cessation of operation. Once revoked, a certificate cannot be reinstated and is no longer usable. The revocation process is global, and the selected certificate is revoked along with its associated ARN. It may take up to 24 hours for the revocation to take effect. The revocation status can be verified using OCSP and the Certificate Revocation List (CRL).

The API reference provides a more extensive list of values for the revocation reason. The RevocationReason values listed in the RevokeCertificate API reference include 11 options, such as KEY_COMPROMISE. Within this list, there are two spellings: SUPERCEDED and SUPERSEDED (Section 10.1). When a certificate is revoked, an ACM Certificate Revoked event is triggered in EventBridge. The example provided on the Amazon EventBridge support for ACM page in the user guide for this event includes the CertificateKeyPairOrigin and Exportable fields.

The ability to initiate revocation can be restricted using IAM. The "Use condition keys with ACM" page states that for RevokeCertificate, the value of the acm:CertificateKeyPairOrigin condition key is read from the existing certificate (Section 2.9).

6.3 ACME — The ACME Endpoint's revoke-cert URL

Certificates issued through ACME are revoked using the ACME protocol. The user guide's "ACME certificate automation" page states that the ACME client initiates revocation through the ACME endpoint's revoke-cert URL. The "Issuing certificates through ACME" page states that the ACM API cannot revoke ACME-issued certificates.

Revocation through ACME only: Use the ACME endpoint's revoke-cert URL. The ACM RevokeCertificate API does not work for ACME-issued certificates.

ACME revocation is authorized with the IAM role associated with the ACME client's external account binding (EAB). The same page also states that IAM policies and Service Control Policies (SCPs) corresponding to the standard acm:RevokeCertificate action also apply to ACME certificate revocation. The "Condition keys for ACME certificate requests" page specifies that ACM only sets one condition key for ACME certificate revocation: acm:CertificateKeyPairOrigin, with a value of ACME. This page further states that a statement that requires acm:KeyAlgorithm with a StringEquals condition never matches a revocation request and denies all ACME revocation.

Stopping an ACME account is a separate operation from certificate revocation. The RevokeAcmeAccount API reference states that this operation stops the ACME account from requesting or revoking certificates and that it is irreversible. It does not state that the operation revokes certificates that were already issued.

6.4 Deleting Certificates

ACM certificates are deleted with DeleteCertificate. The API reference states that this operation deletes the certificate and its associated private key. Once a certificate is deleted, it can no longer be used within integrated services. Certificates currently in use by other AWS services cannot be deleted; you must first disassociate them. The deletion process is eventually consistent, so immediately after deletion, the certificate may still appear in the results of ListCertificates for a short period. The user guide's page on certificate revocation recommends deleting certificates rather than revoking them when they are no longer needed.

The sources disagree on whether certificates issued through ACME can be deleted. The user guide's pages on ACME certificate automation and deleting certificates managed by AWS Certificate Manager both state that expired ACME certificates can be deleted. However, the DeleteCertificate API reference states that certificates with a CertificateKeyPairOrigin of ACME cannot be deleted (see Section 10.1). Both sources state that ACM automatically deletes ACME certificates one year after they expire.

6.5 Revocation and Deletion Table

The following table is the table for the Revocation and deletion aspect.

Path	Handled By	What You Configure	How You Can Check It	Where the Source Says So
Managed	You	Deletion with DeleteCertificate (after removing the association with integrated services). Revocation is not available via the API according to the user guide; the FAQ says it can be requested through a support case.	API operation: DeleteCertificate	Revoke an AWS Certificate Manager public certificate, ACM FAQ, DeleteCertificate
Exportable	You	If exported, use RevokeCertificate (specify a reason). Deletion follows the same process as for Managed certificates.	EventBridge event: ACM Certificate Revoked. API field: DescribeCertificate (check RevokedAt and RevocationReason).	RevokeCertificate, Revoke an AWS Certificate Manager public certificate
ACME	Your ACME client	The ACME endpoint's revoke-cert URL. The EAB IAM role needs acm:RevokeCertificate. The sources disagree on deletion.	CloudTrail data event: RevokeCertificate (acm-acme.amazonaws.com)	Issuing certificates through ACME, Condition keys for ACME certificate requests, DeleteCertificate

7. How Certificates Show Up in Listing and Search

This section describes whether certificates from each of the three paths appear in the default results of ListCertificates and SearchCertificates. The table in Section 7.5 is the table for the Listing and search aspect.

7.1 ListCertificates Defaults — Two Filters, by Key Pair Origin and by Key Type

ListCertificates does not, by default, return ACME certificates. The API reference states this as follows:

By default, this action does not return certificates with a CertificateKeyPairOrigin of ACME. To include ACME certificates, specify ACME in the CertificateKeyPairOrigins filter.

The description of the CertificateKeyPairOrigins parameter on the same page states that the default filtering returns only certificates with a key pair origin of AWS_MANAGED or CUSTOMER_PROVIDED. The "Issuing certificates through ACME" page in the user guide provides AWS CLI examples that include ACME certificates in the list.

aws acm list-certificates \
 --certificate-key-pair-origins ACME

ListCertificates also has a default filter based on key type. The way this default is described differs across two pages in the API reference. The main body of the ListCertificates page states that the default filter returns only certificates with the RSA_2048 key type. The description of keyTypes in the Filters data type states that the default filter returns only certificates with either RSA_1024 or RSA_2048 key types that have one or more domains (Section 10.1). Both descriptions can be read as meaning that ECDSA certificates are not included in the default results unless keyTypes is explicitly specified. For managed and exportable certificates, you can choose an ECDSA key when you request the certificate.

The ACME client chooses the key for ACME certificates. In the console settings for the ACME endpoint, ECDSA P-256 is the default key type (Section 9.2). Documentation stating whether ECDSA ACME certificates are included in the results when CertificateKeyPairOrigins is set to ACME and keyTypes is not specified was not found in the sources as of the verification date. If the two defaults simply combine, those certificates would not be included, but this is an inference.

The ACME certificate automation page of the user guide states that ACME-issued certificates have standard ACM ARNs and appear in the ACM certificate inventory. This is distinct from whether they appear in the default results of ListCertificates.

7.2 SearchCertificates Defaults — Opposite Statements on Two User Guide Pages

SearchCertificates is a search API announced in What's New on April 7, 2026. The Search certificates managed by AWS Certificate Manager page in the user guide lists ACM attributes that can be used for filtering, such as whether a certificate can be exported (export option), whether it has been exported, the key pair origin, the ACME endpoint, and the ACME account.

Two pages of the user guide state opposite things about whether ACME certificates appear in the default results. The Issuing certificates through ACME page states:

SearchCertificates returns ACME certificates by default.

The Search certificates managed by AWS Certificate Manager page states:

Certificates issued through ACME are returned only when you set the certificate key pair origin filter to ACME.

As of the verification date, no statement on the default handling of ACME certificates was found in the SearchCertificates API reference (Section 10.2). This article does not determine which of these descriptions is correct. However, the method of specifying ACME in the key pair origin filter when you want to ensure that ACME certificates are included in the results does not contradict either page. The user guide provides an example using the AWS CLI.

aws acm search-certificates \
 --filter-statement '{"Filter": {"AcmCertificateMetadataFilter": {"CertificateKeyPairOrigin": "ACME"}}}'

7.3 Console Behavior

The Issuing certificates through ACME page in the user guide states that in the ACM console, you use the filter to include certificates with an ACME key pair origin. The ACME endpoints page in the user guide also states that the Certificates dashboard in the console provides an overview of all certificates associated with an account, including those issued through ACME. The Type column in the console's certificate list displays one of three values: Amazon issued, Private, or Imported (as described on the Search certificates managed by AWS Certificate Manager page). How ACME certificates are shown in this column was not found in the sources as of the verification date.

7.4 How They Show Up in EventBridge Events

ACM's EventBridge events carry fields that help tell the three paths apart. The examples of events listed on the Amazon EventBridge support for ACM page in the user guide – ACM Certificate Approaching Expiration, ACM Certificate Expired, ACM Certificate Available, and ACM Certificate Revoked – all include the CertificateKeyPairOrigin field. The examples for ACM Certificate Expired and ACM Certificate Available include the Exported and InUse fields, while the example for ACM Certificate Revoked includes the Exportable field.

7.5 Listing and Search Table

The following table is the table for the Listing and search aspect.

Path	Handled By	What You Configure	How You Can Check It	Where the Source Says So
Managed	ACM (applies the default filters), You (sets the filters)	keyTypes in the Includes of ListCertificates (for keys other than RSA_2048)	API operation: ListCertificates, SearchCertificates. API field: ExportOption	ListCertificates, Filters, Search certificates managed by AWS Certificate Manager
Exportable	ACM (applies the default filters), You (sets the filters)	Same as "Managed." Refine using ExportOption and Exported.	API field: ExportOption, Exported	ListCertificates, Filters, Search certificates managed by AWS Certificate Manager
ACME	ACM (applies the default filters), You (sets the filters)	ACME in the CertificateKeyPairOrigins of ListCertificates. ACME in the key pair origin filter of SearchCertificates.	API field: CertificateKeyPairOrigin. AcmeEndpointArn and AcmeAccountId in DescribeCertificate and SearchCertificates	ListCertificates, Issuing certificates through ACME, Search certificates managed by AWS Certificate Manager

8. What Gets Recorded — CloudTrail, Metrics, and the Console

This section details which CloudTrail events record the operations on certificates from the three paths. It also describes the extent to which ACME issuance can be monitored through CloudWatch metrics and the console. The table in Section 8.6 is the table for the What gets recorded aspect.

8.1 Management Events — ACM API and ACME Account Operations

The "ACM API actions supported in CloudTrail logging" page of the user guide states that ACM records both management events and data events in CloudTrail. Regarding management events, it states:

ACM logs the following operations as CloudTrail management events. Management events are logged by default.

As of the verification date, the page lists 38 operations as management events. This list includes ACM API operations related to managed and exportable certificates (such as RequestCertificate, DescribeCertificate, ExportCertificate, RevokeCertificate, DeleteCertificate, ListCertificates, SearchCertificates, and GetCertificate). It also includes operations for creating, modifying, and deleting ACME endpoints, domain validations, and external account bindings (EABs) (such as CreateAcmeEndpoint, CreateAcmeDomainValidation, CreateAcmeExternalAccountBinding, and others), and RevokeAcmeAccount. In the examples on this page, the eventSource for these events is acm.amazonaws.com.

In addition, three operations related to ACME accounts are also included in the list of management events. These are account registration (NewAccount), account key changes (ChangeAccountKey), and account management (ManageAccount). In the examples on this page, the eventSource for these three events is acm-acme.amazonaws.com, and the principalId in userIdentity is anonymous.

8.2 Data Events — ACME Orders, Certificate Retrieval, and Revocation

Nine operations within the ACME protocol – including order placement, certificate retrieval, and revocation – are considered data events. The same page states:

ACM logs the following ACME protocol operations as CloudTrail data events. Unlike management events, data events are not logged by default. To record them, configure data event logging in your CloudTrail trail or event data store.

These nine operations are: FinalizeOrder, GetCertificate, GetDirectory, GetOrder, ListOrders, ManageAuthorization, NewNonce, NewOrder, and RevokeCertificate. In the examples provided on this page, the eventSource for these events is acm-acme.amazonaws.com, the eventCategory is Data, and the type of the resources is AWS::CertificateManager::AcmeEndpoint.

Therefore, some ACME operations are logged by default, while others require specific configuration to enable logging. Three ACME operations related to account management are logged by default. However, operations such as order placement, certificate retrieval, and revocation are only logged if data event logging is explicitly enabled. The "Troubleshoot ACME certificate automation" page of the user guide recommends enabling data event logging for the ACME endpoint to provide a centralized view of all ACME activity within the account.

8.3 Two Events with the Same Name — GetCertificate and RevokeCertificate

Both GetCertificate and RevokeCertificate appear in both the list of management events and the list of data events. The management-event GetCertificate and RevokeCertificate are ACM API operations, and their example eventSource is acm.amazonaws.com. For data events, GetCertificate represents downloading a certificate from ACME, and RevokeCertificate represents certificate revocation at an ACME endpoint. In both cases, the example eventSource is acm-acme.amazonaws.com. If you filter CloudTrail events based solely on the eventName, the two types will be mixed together. You also need to check eventSource or eventCategory to tell them apart.

8.4 Console Monitoring Tab and ACME Issuance Metrics

ACM publishes issuance success and failure metrics to CloudWatch for each ACME endpoint. The user guide's "Supported CloudWatch metrics" page lists CertificateIssuanceSuccess and CertificateIssuanceFailed in the AWS/CertificateManager namespace. Both metrics use the AcmeEndpointArn dimension. ACM publishes 1 to CertificateIssuanceSuccess for each successful issuance and 0 otherwise. ACM publishes CertificateIssuanceFailed in the same way for each failed issuance.

The Monitoring tab for ACME endpoints in the ACM console displays graphs of these two metrics. However, this tab only shows results from the final stage of the issuance process. The user guide's "Troubleshoot ACME certificate automation" page states:

The Monitoring tab on the ACME endpoint details page in the ACM console shows events for the final step of certificate issuance—when ACM creates the certificate (see Monitoring ACME endpoints). If your request failed before that step, it doesn't appear there.

The same page provides examples of failures that may occur earlier in the process, such as invalid credentials, domains that have not been validated, and domains that the endpoint does not allow. The ACME client receives these failures directly. As troubleshooting steps, the same page recommends examining the ACME client's logs and CloudTrail data events.

According to the documentation reviewed for this article, no issuance success or failure metrics were found for managed and exportable certificates. The DaysToExpiry metric is emitted for all certificates (see Section 4.5).

Figure 2 shows where the main operations of the three paths show up in CloudTrail, CloudWatch, and the console.

8.5 What the Announcements Say and What the User Guide Says

The What's New post of July 6, 2026 says the following about auditing ACME:

All activity is visible in the ACM console with AWS CloudTrail logging and Amazon CloudWatch metrics for auditability.

The What's New post on ACME over PrivateLink, dated October 6, 2026, contains a sentence to the same effect. The "External account bindings" page in the user guide states that ACME issuance and revocation operations are recorded in CloudTrail. These three statements do not mention the configuration of data event recording. However, as described in Sections 8.2 and 8.4, the CloudTrail page in the user guide states that order placement, certificate retrieval, and revocation operations are treated as data events and are not recorded by default. The "Troubleshooting" page states that the Monitoring tab only displays the results of the final stage. This article reads the sentences in the announcements and on the EAB page as describing the case where data event logging is configured. However, the announcements do not specify this condition (see Section 10.1).

8.6 Table for What Gets Recorded

The following table is the table for the What gets recorded aspect.

Path	Handled By	What You Configure	How You Can Check It	Where the Source Says So
Managed	ACM	Nothing (Management events are recorded by default.)	CloudTrail management event: RequestCertificate, DeleteCertificate, etc. (acm.amazonaws.com)	ACM API actions supported in CloudTrail logging
Exportable	ACM	Nothing (Management events are recorded by default.)	CloudTrail management event: ExportCertificate, RevokeCertificate, etc. (acm.amazonaws.com)	ACM API actions supported in CloudTrail logging
ACME	ACM	To record order, retrieval, and revocation, configure data event logging in CloudTrail's trail or event data store.	CloudTrail management event: NewAccount, ChangeAccountKey, ManageAccount (acm-acme.amazonaws.com). CloudTrail data event: NewOrder, FinalizeOrder, GetCertificate, RevokeCertificate, etc. (acm-acme.amazonaws.com). CloudWatch metric: CertificateIssuanceSuccess, CertificateIssuanceFailed. Console: Monitoring tab (for the final stage only).	ACM API actions supported in CloudTrail logging, Supported CloudWatch metrics, Troubleshoot ACME certificate automation.

9. The Contract of an ACM ACME Endpoint

This section describes the configuration required by users and the responsibilities of ACM regarding the ACME endpoint used to issue certificates. The user guide describes ACME in two planes. In the control plane, PKI administrators use ACM's APIs to create ACME endpoints, domain validations, and external account bindings (EABs). In the data plane, ACME clients register accounts with the ACME protocol endpoint and request certificates for domains that the administrator has validated. The table in Section 9.8 summarizes the content of this section using a common set of columns.

9.1 PRE_APPROVED and Domain Validation in Advance

ACM's ACME endpoints do not verify domain ownership with each certificate request. Instead, they use domains that have been pre-approved by the administrator. The ACME endpoints page in the user guide describes the AuthorizationBehavior value as follows:

PRE_APPROVED: Domain validation is handled by pre-configured domain validation resources rather than live ACME challenges.

The ACME domain validation page in the user guide describes ACME domain validation as a persistent resource that administrators configure in advance. Each domain validation requires a DNS CNAME record, which follows the same format as ACM's standard DNS validation. However, with ACME domain validation, each endpoint requires a separate CNAME record; even for the same domain, a different CNAME record is needed if the endpoint differs.

Domain validation allows you to define the scope for which certificates are issued. This scope can be configured as ExactDomain (the specified domain itself), Subdomains (its subdomains), or Wildcards (for wildcard certificates), and each option can be set to ENABLED or DISABLED. These options are independent and can be combined. ACM validates the CNAME record for up to 72 hours after creating the domain validation. If the record is not found within that time, the domain validation becomes INVALID. Deleting a domain validation does not affect certificates that have already been issued. The CNAME record must remain in DNS as long as the domain validation is in use. The troubleshooting page notes that deleting the CNAME record after the domain validation becomes VALID may cause certificate orders for that domain to fail at the issuance stage.

The ACME issuance process is described in the "Issuing certificates through ACME" page of the user guide. The ACME client registers an account using EAB credentials. Next, it specifies the domain name and creates an order. The ACME server validates the pre-configured domain validation. Because the endpoint uses PRE_APPROVED, the client does not need to respond to live challenges. The client submits a CSR to finalize the order, and ACM issues the certificate. Finally, the client downloads the certificate chain that was issued.

9.2 Contact, AllowedKeyAlgorithms, CertificateTags

When creating an ACME endpoint, users configure the following settings:

• Contact: This setting is either REQUIRED or NOT_REQUIRED. It determines whether contact information is mandatory when the ACME client registers an account. The user guide states that ACME accounts do not have identifying information by default, and that the registered contact information is solely for administrators to manage the account.
• CertificateAuthority: This specifies a PublicCertificateAuthority. According to the user guide, this setting declares that the endpoint issues public certificates through Amazon Trust Services, and does not specify a particular CA.
• AllowedKeyAlgorithms: Chosen from RSA_2048, EC_prime256v1, and EC_secp384r1. If the public key algorithm in the Certificate Signing Request (CSR) does not match any of these, the endpoint will reject the request. The user guide states that if AllowedKeyAlgorithms is not configured, the endpoint does not enforce any specific key algorithms. In the console, users must select at least one key type, with ECDSA P-256 as the default.
• CertificateTags: These are tags that ACM automatically applies to all certificates issued by the endpoint. These tags are separate from any tags applied directly to the endpoint itself.

Regarding the endpoint's status, the user guide lists three states: ACTIVE, DELETING, and FAILED. The API reference for AcmeEndpoint lists four possible values for Status, including CREATING. Each endpoint is assigned a single URL that points to the ACME directory. Administrators provide this URL to the ACME client.

9.3 EAB and IAM Roles

ACME clients cannot request certificates unless they have registered an account. Registering an account requires valid EAB credentials. The user guide's "External account bindings" page describes the handling of EABs as follows:

• When creating an EAB, administrators must associate an IAM role. This role determines what the ACME client is permitted to do with certificate issuance and revocation.
• The role's trust policy must allow the ACME service principal (acm-acme.amazonaws.com) to perform sts:AssumeRole, sts:TagSession, and sts:SetSourceIdentity.
• The role must have either the acm:RequestCertificate permission for issuing certificates, the acm:RevokeCertificate permission for revoking certificates, or both. These are the same permissions and condition keys as the standard ACM API uses.
• Administrators creating EABs must have the iam:PassRole permission for that role.
• EABs generate a key ID and a MAC key. The user guide specifies that the MAC key should be treated as a secret and distributed only to ACME clients that have been explicitly authorized to use it. The key ID and MAC key can be retrieved at any time using GetAcmeExternalAccountBindingCredentials.
• EAB credentials can have an expiration time set, measured in minutes, hours, or days. If no expiration time is set, the credentials remain valid until the EAB is revoked or deleted.

EABs and ACME accounts have separate lifecycles. The same page states:

Revoking or deleting an EAB does not affect existing ACME accounts created with it.

To prevent further issuance through an ACME account, you must handle the account itself. The user guide indicates that you can revoke the account using RevokeAcmeAccount or the account holder can deactivate the account using the ACME protocol.

When configuring CertificateTags for an endpoint, the EAB role must also have the acm:AddTagsToCertificate permission. The "Condition keys for ACME certificate requests" page of the user guide states that if the EAB role only allows acm:RequestCertificate, the role cannot issue certificates from an endpoint that has certificate tags.

9.4 ACME Issuance and Revocation: Condition Keys Set by ACM

ACME issuance is authorized as ACM's acm:RequestCertificate action. The "Condition keys for ACME certificate requests" page of the user guide lists the values for the condition keys that ACM sets when the ACME client finalizes an order. The Document history entry dated September 28, 2026, states that these values were added to the documentation.

Condition Key	Value for ACME Issuance
acm:CertificateKeyPairOrigin	Always ACME
acm:DomainNames	Domain names taken from the subject alternative names (SANs) in the CSR.
acm:KeyAlgorithm	Public key algorithm of the CSR: RSA_2048, EC_prime256v1, or EC_secp384r1.
acm:ValidationMethod	Always DNS
acm:CertificateTransparencyLogging	Always ENABLED
acm:Export	Always ENABLED

ACM does not set the acm:CertificateAuthority condition key during ACME issuance. The same page states that to restrict which CA the ACME endpoint issues from, you configure the endpoint itself. During ACME revocation, ACM only sets the acm:CertificateKeyPairOrigin condition key (see Section 6.3).

The same page provides the following note on how to write conditions:

Write conditions against the keys listed for the action you are restricting: a condition on a key that an action does not carry denies that action outright.

When an ACME request is rejected due to policy restrictions, the ACME client receives the urn:ietf:params:acme:error:unauthorized error. If the endpoint rejects the request (for example, due to a CSR with an unsupported key algorithm), the client receives urn:ietf:params:acme:error:badCSR. The user guide clarifies that the latter is the result of the endpoint's configuration, rather than a policy restriction.

9.5 Quotas

The "Quotas" page of the user guide states that certificates issued through ACME are not counted against the quota for the number of ACM certificates.

Certificates issued through ACME do not count toward this total.

This sentence appears in the descriptions of both the quota for the number of ACM certificates (default: 2,500) and the quota for the number of ACM certificates per year (default: 5,000). The same page also lists the following values for ACME's own quotas: a maximum of 100 domain names per certificate issued through ACME, which cannot be increased; 50 ACME endpoints per AWS account and region; 1,000 EABs per ACME endpoint; and 1,500 domain validations per ACME endpoint. The ACM API rate limits for ACME certificate automation are as follows: 30 requests per second for read operations, 20 for write operations, and 5 for creating, modifying, or deleting domain validations.

9.6 PrivateLink and Available Regions

ACME issuance can also be performed via AWS PrivateLink. This was announced in a What's New post on October 6, 2026. The user guide page, "Issuing ACME certificates over AWS PrivateLink," states that two VPC endpoint services are available for ACME.

• com.amazonaws.region.acm-acme: This service receives ACME management operations used by PKI administrators (e.g., CreateAcmeEndpoint).
• com.amazonaws.region.acm-acme-enroll: This service receives ACME protocol requests used by ACME clients for issuance and revocation.

The same page notes that these two services are independent, and one VPC endpoint does not grant access to the other. Each service has its own endpoint policy. For issuance via the VPC endpoint, it is necessary to enable private DNS hostnames. When defining the VPC endpoint policy to restrict access to specific ACME endpoints, you must handle both the ACME endpoint resource and the certificate resource. This is because order finalization and revocation are evaluated as acm:RequestCertificate and acm:RevokeCertificate against the certificate resource. The ACM PrivateLink support, announced in the What's New post of August 15, 2025, is for calling the ACM API from within a VPC and is a separate announcement from the two ACME endpoint services.

Regarding available regions, the What's New posts of July 6, 2026, and October 6, 2026, both state:

available in all commercial AWS Regions

9.7 Deleting ACME Endpoints

The sources disagree on what is deleted together with an ACME endpoint. The user guide's page on ACME endpoints states that deleting an endpoint also deletes its external account bindings (EABs) and domain validation resources, as well as the ACME accounts registered with the endpoint. The DeleteAcmeEndpoint API reference indicates that the endpoint's URL will become unavailable, and the associated EAB and domain validation will be deleted; however, it does not mention the ACME account (see Section 10.1).

9.8 ACME Endpoint Table

The following table summarizes the configuration of ACME endpoints, organized by the common columns described in Section 2.3. In this table, the Aspect column holds the items of the ACME endpoint.

Aspect	Handled By	What You Configure	How You Can Check It	Where the Source Says So
Domain approval	You (creates the validation and the CNAME record), ACM (checks the record)	Domain validation setup, including ExactDomain, Subdomains, and Wildcards. DNS CNAME record.	API operation: DescribeAcmeDomainValidation (status and failure reasons).	ACME domain validation
Account registration	You (issues the EAB), Your ACME client (registers the account)	EAB creation and distribution. Contact information.	API operation: DescribeAcmeAccount, ListAcmeAccounts. CloudTrail management event: NewAccount.	External account bindings, ACME endpoints
Issuance and revocation authorization	ACM	IAM role permissions and condition keys associated with the EAB.	CloudTrail data event: FinalizeOrder, RevokeCertificate.	External account bindings, Condition keys for ACME certificate requests
Key algorithms	ACM	AllowedKeyAlgorithms.	API operation: DescribeAcmeEndpoint.	ACME endpoints
Certificate tags	ACM	CertificateTags and the IAM role's acm:AddTagsToCertificate permission.	API operation: DescribeAcmeEndpoint.	ACME endpoints, Condition keys for ACME certificate requests
Network path	You	VPC endpoint for com.amazonaws.region.acm-acme-enroll and its associated policy.	Documentation only: User guide, PrivateLink section.	Issuing ACME certificates over AWS PrivateLink

10. Where the Sources Disagree and Where No Statement Was Found

This section collects, in one place, the main points from Sections 3 through 9 where the sources disagree and where no statement was found after searching. Where the sources disagree, this article does not call either side wrong. It presents both statements with the verification date.

10.1 Where the Sources Disagree

The following two tables list where the sources disagree as of the verification date (October 12, 2026). The first table covers the disagreements on validity periods, types, listing, deletion, renewal, and export.

#	Topic	One Source Says	Another Source Says	Section
1	Certificate Validity Period	One question in the ACM FAQ states that the validity period for public certificates issued through ACM is 198 days.	Another question in the same FAQ states that the renewal process begins up to 60 days before expiration and that the validity period is currently 13 months (395 days). The DNS renewal page in the user guide states that certificates issued with a 395-day validity period renew 60 days before expiration and that certificates with a 198-day validity period renew 45 days before expiration.	4.4
2	Number of Certificate Types	One question in the ACM FAQ lists four types: Public, Exportable public, Private, and Imported.	Another question in the same FAQ, and the "Types of certificates in AWS Certificate Manager" page in the user guide, list three types: Public, Private, and Imported.	2.2
3	Previous Validity Period Mentioned in the 198-Day Announcement	One statement in the What's New post of February 18, 2026, states that the previous validity period was 395 days.	Another statement in the same announcement states that existing certificates with a 398-day validity period renew 60 days before expiration.	4.4
4	Default Key Type for ListCertificates	The API reference for ListCertificates states that by default, it only returns certificates with the RSA_2048 key type.	The description for keyTypes in the Filters data type states that by default, it returns certificates with either RSA_1024 or RSA_2048 key types, provided they have one or more domains.	7.1
5	Does SearchCertificates Default to Returning ACME Certificates?	The "Issuing certificates through ACME" page in the user guide states that SearchCertificates defaults to returning ACME certificates.	The "Search certificates managed by AWS Certificate Manager" page in the user guide states that ACME certificates are returned only when the key pair origin filter is set to ACME.	7.2
6	Can ACME Certificates Be Deleted?	The "ACME certificate automation" page in the user guide, and the "Delete certificates managed by AWS Certificate Manager" page, state that expired ACME certificates can be deleted.	The API reference for DeleteCertificate states that certificates with a CertificateKeyPairOrigin of ACME cannot be deleted.	6.4
7	Scope of RenewCertificate	The "Force certificate renewal" page in the user guide lists ACM public and private certificates, specifying that the target is an exported certificate.	The description for RenewalEligibility in the API reference states that only exported private certificates can be renewed using RenewCertificate.	4.2
8	Can Export Be Changed After Creation?	The API reference for CertificateOptions states that the Export value cannot be changed after creation. The "Request a public certificate in AWS Certificate Manager" page in the user guide states that to export a certificate, a new certificate must be created with export enabled.	The API reference for UpdateCertificateOptions states that this operation lets you change the domain validation method or specify whether to export the certificate. The introduction of the CertificateOptions page itself also says that the structure can be used to specify whether to export your certificate.	2.1

Item 8's CertificateOptions sentence, quoted as published, is as follows:

You cannot update the value of Export after the the certificate is created.

The API reference description for UpdateCertificateOptions is as follows:

You can use this operation to change the domain validation method or specify whether to export your certificate.

The second table covers the disagreements on ACME endpoints, dates, auditing, the wording and reasons for revocation, the FAQ, renewal conditions, and events.

#	Topic	One Source Says	Another Source Says	Section
9	Deletion of ACME Endpoints: What is Removed	The user guide's ACME endpoints page states that, in addition to EABs and domain validations, ACME accounts registered with the endpoint are also deleted.	The DeleteAcmeEndpoint API reference states that EAB and domain validation are deleted, but does not mention ACME accounts.	9.7
10	Date ACME Was Introduced	The user guide's Document history for ACME lists the date as June 18, 2026.	An AWS News Blog article about ACME was published on June 30, 2026. The What's New post has a postDateTime of July 6, 2026. An AWS Security Blog article about ACME was published on August 6, 2026.	1.1
11	Scope of ACME Auditing	The What's New posts of July 6 and October 6, 2026, state that all activity is visible in the ACM console with CloudTrail logging and CloudWatch metrics. The "External account bindings" page states that issuance and revocation operations are logged in CloudTrail.	The user guide's CloudTrail page states that the ACME order, retrieval, and revocation operations are data events and are not recorded by default. The "Troubleshooting" page states that the Monitoring tab only shows the final stage of issuance.	8.5
12	Conditions for Revocation	The RevokeCertificate API reference and the user guide's revocation page state that only previously exported certificates can be revoked.	The ACM FAQ states that exportable public certificates can be revoked using revoke-certificate.	6.2
13	Mentions of ACME	The user guide, API reference, What's New posts, and blogs mention ACME-issued certificates.	As of the verification date, the ACM FAQ page does not contain the word ACME.	2.2
14	Conditions for Automated Renewal	The "Managed certificate renewal in AWS Certificate Manager" page states that certificates exported after issuance or the last renewal are eligible for automated renewal.	The "Renewal for domains validated by DNS" page lists two conditions for renewal: being in use with an AWS service and having a CNAME record. It does not mention exporting.	4.2
15	Default Start of Expiration Event	The user guide's "Amazon EventBridge support for ACM" page states that for private and imported certificates, expiration events are sent starting 45 days before expiration, and for public certificates, starting 30 days before expiration.	The PutAccountConfiguration API reference states that by default, events are received starting 45 days before expiration, without differentiating between certificate types.	4.5
16	Revocation Reasons	The user guide's revocation page lists four possible reasons: Unspecified, Affiliation changed, Superseded, and Cessation of operation.	The RevokeCertificate API reference's RevocationReason lists 11 possible values, including both SUPERCEDED and SUPERSEDED.	6.2

The four dates in item 10 are the date of the user guide change, the publication dates of the two blog posts, and the date of the announcement, each the date of a different thing. This article dates the launch of ACME by the What's New post of July 6, 2026.

10.2 Where No Statement Was Found

The following table lists the statements that this article looked for and did not find. In all cases, searches were performed on October 12, 2026, using the terms listed in each row, in the sources listed in Section 1.3. The absence of results does not constitute proof of non-existence.

What Was Looked For	Where and How It Was Looked For	Result
The value of the CertificateKeyPairOrigin field for managed and exportable certificates	Searched the API reference for CertificateDetail, CertificateSummary, AcmCertificateMetadata, the user guide's pages on public certificates, export, condition keys, and search, as well as the FAQ, using the terms CertificateKeyPairOrigin, AWS_MANAGED, and export.	No explicit mentions were found. Three clues were identified: condition key values, search examples, and notes on integrated services (Section 2.9).
Whether the SearchCertificates API defaults to returning ACME certificates, based on the API reference.	Searched the API reference for SearchCertificates, AcmCertificateMetadataFilter, and the CLI command search-certificates, using the terms ACME and default.	The term ACME appears only in filter, sort, and result fields and values. No descriptions regarding default behavior were found (Section 7.2).
The value of the Type field for ACME certificates.	Searched the API reference for the Type field of CertificateDetail and CertificateSummary, the user guide's ACME pages, and the console's description of the "Type" column, using the terms AMAZON_ISSUED and Type.	No statement on this value was found (Sections 2.2 and 7.3).
The IssueCertificate CloudTrail event that the troubleshooting page mentions	Searched the user guide's CloudTrail page, looking at the lists and examples of management and data events, using the term IssueCertificate.	The troubleshooting page states that if data events are logged, failures will appear in the serviceEventDetails of the IssueCertificate CloudTrail event. However, IssueCertificate was not found in the list on the CloudTrail page.
The CloudTrail events for RenewCertificate, UpdateCertificateOptions, and PutAccountConfiguration.	Searched the user guide's CloudTrail page, looking at the lists of operations by name.	No mentions were found in the list of operations. No descriptions stating that these events are not logged were found either.
The entries related to ACME's PrivateLink in the Document history.	Searched the user guide's Document history, using the term PrivateLink.	No mentions were found (Section 1.1).
When specifying ACME for CertificateKeyPairOrigins and not specifying keyTypes, will ECDSA ACME certificates be included in the results of ListCertificates?	Searched ListCertificates, Filters, and the user guide's ACME pages, using the terms keyTypes, ACME, and default.	No statement on this combination was found (Section 7.1).
Issuance success or failure metrics for managed and exportable certificates	Searched the user guide's "Supported CloudWatch metrics" page.	As of the verification date, the metrics on the page are DaysToExpiry, CertificateIssuanceSuccess, and CertificateIssuanceFailed. The latter two are metrics for the ACME endpoint (Section 8.4).
ACME-related descriptions in the ACM FAQ.	Searched the HTML of the ACM FAQ page, using the term ACME.	No results were found (Section 2.2).

11. Frequently Asked Questions about How ACM Issues Public Certificates

This section answers, within the scope of this article, questions that come up when you choose among the three paths or take inventory of existing certificates.

Q1. Can an existing managed certificate be changed into an exportable certificate later?

The sources disagree. The CertificateOptions API reference states that the Export setting cannot be changed after the certificate is created. The user guide's page on requesting a public certificate states that to export a certificate, a new certificate must be created with export enabled. The UpdateCertificateOptions API reference indicates that this operation allows you to specify whether the certificate should be exportable (Section 10.1, item 8). The API reference, the CLI reference, and the user guide all state that ACM public certificates created before June 17, 2025, cannot be exported.

Q2. Can certificates issued through ACME be attached to an Application Load Balancer or CloudFront?

No. The user guide states that certificates issued through ACME cannot be used with integrated services such as Elastic Load Balancing, CloudFront, and API Gateway. It specifies that to use certificates with these integrated services, you must use certificates with a key pair origin of either AWS_MANAGED or CUSTOMER_PROVIDED (see Section 5.3).

Q3. Does ACM renew certificates issued through ACME?

No. ACM does not automatically renew certificates issued through ACME. Instead, the ACME client requests a new certificate before the existing one expires. ACME certificates are valid for 45 days (see Section 4.3).

Q4. If there is a suspected compromise of a managed certificate's private key, can it be revoked?

Not through the ACM API. The user guide states that certificates that cannot be exported cannot be revoked, and advises users to delete certificates that are no longer needed. The ACM FAQ states that for public certificates, it is possible to create a case with the AWS Support Center and request revocation. This article presents these two statements side by side without favoring either (Section 6.1). The private key of a managed certificate is encrypted and stored by ACM, and users cannot retrieve it (Section 3.1).

Q5. Are ACME operations recorded in CloudTrail by default?

Only partially. Three ACME protocol operations – account registration, key changes, and management – are recorded by default as management events. Nine other ACME protocol operations, such as order placement, certificate retrieval, and certificate revocation, are data events and are not recorded by default. To record these, you must configure data event logging in either a CloudTrail trail or an event data store (see Sections 8.1 and 8.2).

Q6. Why aren't ACME certificates appearing in the ListCertificates results?

This is due to the default filtering. By default, ListCertificates does not return certificates with a CertificateKeyPairOrigin of ACME. To include them, specify ACME in the CertificateKeyPairOrigins filter. There is also a default filter on the key type, and the two pages of the API reference describe that default differently (Section 7.1).

Q7. What is the CertificateKeyPairOrigin of an exportable certificate?

No statement that names it was found in the sources as of the verification date. While the IAM condition key acm:CertificateKeyPairOrigin is always AWS_MANAGED when using RequestCertificate, this value is used during authorization of the request and the "Use condition keys with ACM" page does not call it a field value of the certificate itself. To differentiate between managed and exportable certificates, refer to the ExportOption or Options.Export (see Section 2.9).

Q8. Are certificates issued through ACME counted towards ACM's certificate quota?

No. The "Quotas" page of the user guide states that certificates issued through ACME are not counted towards either the ACM certificate count quota or the annual quota. ACME has separate quotas for the number of endpoints, EABs, and domain validations (see Section 9.5).

Q9. When was the information in this article verified?

It was verified on October 12, 2026 (Japan Standard Time). The user guide, API reference, and FAQ do not have version numbers, so the verification date is noted. Disagreements between sources, such as the validity period in the FAQ or the statements on deleting ACME-issued certificates, may change after the verification date (see Section 10.1).

12. Summary

• The three paths are this article's own division: Managed, Exportable, and ACME are divided by who holds the private key and by the operation that gets the certificate. The sources divide certificates into three types, four types, three columns, or three values, depending on the source.
• Private Key: For managed and exportable certificates, ACM generates and stores the private key, and only exportable certificates let users retrieve it. For ACME, the ACME client generates and stores the private key, and ACM does not have access to it.
• Renewal: For managed certificates, if the renewal conditions are met, ACM attempts to renew the certificate 45 days before expiration, and ACM is also responsible for replacing it in the integrated service. For exportable certificates, ACM handles the renewal, and the user is responsible for deployment. The sources describe the renewal conditions for exportable certificates differently (Section 10.1, item 14). For ACME, the ACME client handles the renewal, and the validity period is 45 days.
• Where it can be attached: Managed certificates can be used with integrated services. Exportable certificates can be used with integrated services and outside AWS. Certificates issued through ACME cannot be attached to integrated services.
• Revocation and Deletion: Managed certificates cannot be revoked through the ACM API, and the FAQ describes a support case. Exportable certificates can be revoked with RevokeCertificate if they have been exported. ACME certificates are revoked by the ACME client through the ACME endpoint's revoke-cert URL. The sources disagree on whether ACME certificates can be deleted.
• Listing and search: ListCertificates does not, by default, return ACME certificates. Whether SearchCertificates returns them by default is stated in opposite ways on two pages of the user guide. The differentiating fields are CertificateKeyPairOrigin and either ExportOption or Options.Export.
• What gets recorded: The ACM API operations and ACME account operations that the CloudTrail page lists as management events are recorded by default. ACME order, retrieval, and revocation operations are data events and require specific configuration to be logged. The Monitoring tab only displays the results of the final stage of issuance. The What's New posts and the External account bindings page describe the scope of auditing differently (Section 10.1, item 11).
• Where the sources disagree: This article lists 16 main points where the sources disagree. It does not call either side wrong and presents both statements as they stood on the verification date. Designs and automations that rely on these points should be re-verified by retrieving the latest documentation.

13. References

• ACME certificate automation - AWS Certificate Manager User Guide
• ACME endpoints - AWS Certificate Manager User Guide
• ACME domain validation - AWS Certificate Manager User Guide
• External account bindings - AWS Certificate Manager User Guide
• Issuing certificates through ACME - AWS Certificate Manager User Guide
• Issuing ACME certificates over AWS PrivateLink - AWS Certificate Manager User Guide
• Troubleshoot ACME certificate automation - AWS Certificate Manager User Guide
• Condition keys for ACME certificate requests - AWS Certificate Manager User Guide
• Use condition keys with ACM - AWS Certificate Manager User Guide
• AWS Certificate Manager public certificates - AWS Certificate Manager User Guide
• Request a public certificate in AWS Certificate Manager - AWS Certificate Manager User Guide
• AWS Certificate Manager exportable public certificates - AWS Certificate Manager User Guide
• Export an AWS Certificate Manager public certificate - AWS Certificate Manager User Guide
• Revoke an AWS Certificate Manager public certificate - AWS Certificate Manager User Guide
• Force certificate renewal - AWS Certificate Manager User Guide
• Managed certificate renewal in AWS Certificate Manager - AWS Certificate Manager User Guide
• Renewal for domains validated by DNS - AWS Certificate Manager User Guide
• Search certificates managed by AWS Certificate Manager - AWS Certificate Manager User Guide
• Delete certificates managed by AWS Certificate Manager - AWS Certificate Manager User Guide
• Types of certificates in AWS Certificate Manager - AWS Certificate Manager User Guide
• Choosing how to issue certificates with AWS - AWS Certificate Manager User Guide
• Managed automation with integrated services - AWS Certificate Manager User Guide
• Data protection in AWS Certificate Manager - AWS Certificate Manager User Guide
• ACM API actions supported in CloudTrail logging - AWS Certificate Manager User Guide
• Supported CloudWatch metrics - AWS Certificate Manager User Guide
• Amazon EventBridge support for ACM - AWS Certificate Manager User Guide
• Quotas - AWS Certificate Manager User Guide
• Document history - AWS Certificate Manager User Guide
• RequestCertificate - AWS Certificate Manager API Reference
• ExportCertificate - AWS Certificate Manager API Reference
• RevokeCertificate - AWS Certificate Manager API Reference
• RenewCertificate - AWS Certificate Manager API Reference
• DeleteCertificate - AWS Certificate Manager API Reference
• ListCertificates - AWS Certificate Manager API Reference
• SearchCertificates - AWS Certificate Manager API Reference
• DescribeCertificate - AWS Certificate Manager API Reference
• UpdateCertificateOptions - AWS Certificate Manager API Reference
• PutAccountConfiguration - AWS Certificate Manager API Reference
• DeleteAcmeEndpoint - AWS Certificate Manager API Reference
• RevokeAcmeAccount - AWS Certificate Manager API Reference
• CertificateDetail - AWS Certificate Manager API Reference
• CertificateSummary - AWS Certificate Manager API Reference
• CertificateOptions - AWS Certificate Manager API Reference
• Filters - AWS Certificate Manager API Reference
• AcmCertificateMetadata - AWS Certificate Manager API Reference
• AcmCertificateMetadataFilter - AWS Certificate Manager API Reference
• AcmeEndpoint - AWS Certificate Manager API Reference
• list-certificates - AWS CLI Command Reference
• search-certificates - AWS CLI Command Reference
• describe-certificate - AWS CLI Command Reference
• export-certificate - AWS CLI Command Reference
• revoke-certificate - AWS CLI Command Reference
• AWS Certificate Manager FAQs
• AWS Certificate Manager introduces public certificates you can use anywhere - What's New
• AWS Certificate Manager supports AWS PrivateLink - What's New
• ACM now supports automated certificate management for Kubernetes - What's New
• AWS Certificate Manager updates default certificate validity to comply with new guidelines - What's New
• AWS Certificate Manager now supports native certificate search - What's New
• AWS announces AWS Workload Credentials Provider - What's New
• AWS Certificate Manager now supports the ACME protocol for public certificates - What's New
• AWS Certificate Manager supports switching from e-mail to DNS validation - What's New
• AWS Certificate Manager now supports ACME issuance through AWS PrivateLink - What's New
• AWS Certificate Manager introduces exportable public SSL/TLS certificates to use anywhere - AWS News Blog
• AWS Certificate Manager now supports exporting public certificates - AWS Security Blog
• Automate public TLS certificate issuance with ACME support in AWS Certificate Manager - AWS News Blog
• Automate certificates with ACME support in AWS Certificate Manager - AWS Security Blog
• AWS Certificate Manager will discontinue email validation to prove domain validation for certificates - AWS Security Blog

References:
Tech Blog with curated related content