5.2.2. Encryption in Transit: ACM and TLS Certificate Management
💡 First Principle: Encryption in transit protects data as it moves between systems — between users and your application, between microservices, and between AWS services. TLS (Transport Layer Security) is the protocol; certificates are the mechanism that proves identity and establishes the encrypted channel. The operational challenge is certificate lifecycle management: provisioning, deploying, and rotating certificates before they expire.
AWS Certificate Manager (ACM):
ACM provisions, manages, and renews SSL/TLS certificates for use with AWS services. Key characteristics:
| Feature | Detail |
|---|---|
| Public certificates | Free; valid for use with ALB, CloudFront, API Gateway, Elastic Beanstalk |
| Private certificates | ACM Private CA (~$400/month); for internal services |
| Auto-renewal | Public certificates renew automatically (no intervention needed if DNS validation) |
| Export | A standard public certificate cannot be exported: its private key stays in AWS and it works only with integrated services. An exportable public certificate (chosen when you request it, charged per certificate) can be exported with its private key for EC2, containers or on-premises servers |
| Region-specific | Certificates are issued per region; CloudFront requires certs in us-east-1 |
Certificate Validation Methods:
| Method | How It Works | Best For |
|---|---|---|
| DNS validation | Add CNAME record to your DNS zone; ACM checks it | Automated renewal; preferred method |
| Email validation | Confirmation email to registered domain contacts | When you don't control DNS directly |
ACM starts managed renewal 45 days before expiry (60 days for older 395-day certificates). A DNS-validated certificate renews with no action only while it is in use by an AWS service and its validation CNAME is still in public DNS; if the record was removed, renewal stalls until it is restored, and ACM sends AWS Health and EventBridge warnings as expiry approaches. Email-validated renewals need someone to approve the renewal email; when that can't happen, request a replacement certificate with DNS validation and attach it to the listener.
ACM with ALB: The most common pattern — attach an ACM certificate to an ALB listener for HTTPS termination. The ALB terminates TLS and forwards HTTP (or re-encrypted HTTPS) to targets. Backend targets don't need their own certificates. The TLS versions and ciphers an HTTPS listener accepts are set by its security policy (for example, ELBSecurityPolicy-TLS13-1-2-2021-06 allows only TLS 1.2 and 1.3). Security groups filter ports and addresses, not protocol versions, so the listener policy is the control.
End-to-End Encryption Pattern:
For compliance scenarios requiring encryption all the way to the instance (not just to the load balancer), configure:
- ALB → HTTPS listener with ACM cert (terminates TLS from clients)
- ALB → HTTPS target group (re-encrypts to backend instances)
- Backend instances → self-signed cert or ACM Private CA cert
Certificate Lifecycle (Non-ACM): For certificates imported into ACM (from external CAs) or installed on EC2 instances directly, you're responsible for renewal. Common operational failure: certificates expire and cause outages. Mitigations:
- CloudWatch metric:
aws:certificatemanager:DaysToExpiry - Set an alarm at 45 days to expiry
- Use ACM wherever possible to eliminate manual renewal
⚠️ Exam Trap: A standard ACM public certificate cannot be exported — its private key never leaves AWS, so you cannot install it on an EC2 instance running Nginx or on an on-premises server. When a server needs the certificate and key itself, use an exportable public certificate from ACM (an extra-cost option chosen at request time; ACM renews it, but you deploy each renewed certificate yourself), a certificate from ACM Private CA for internal names, or a certificate from a third-party CA.
Reflection Question: Your ALB serves api.company.com over HTTPS using an ACM certificate. A compliance requirement now mandates that traffic must be encrypted all the way to the EC2 instance backend (not just to the ALB). What change do you make, and what type of certificate do the backend instances need?
