AWS Certificate Manager (ACM): TLS Certificates and Encryption in Transit – SAP-C02 Study Guide

Purpose of This Lesson

AWS Certificate Manager (ACM) simplifies the lifecycle of SSL/TLS certificates used to secure network connections. For the SAP-C02 exam, the most important distinction is that ACM manages certificates for encryption in transit, while AWS KMS and CloudHSM primarily manage cryptographic keys used for encryption and other cryptographic operations.

Key Concepts

What AWS Certificate Manager Provides

ACM can be used to:

• Request and issue SSL/TLS X.509 certificates
• Store certificates for use with supported AWS services
• Automatically renew eligible certificates
• Request certificates for a single domain or multiple domain names
• Use wildcard certificates, such as *.example.com
• Import certificates issued by an external certificate authority
• Create and operate a private certificate authority through ACM Private CA
• Deploy certificates to integrated AWS services

TLS certificates establish the identity of a server and enable encrypted client-to-server communication. They are commonly used to provide HTTPS access to applications.

Public and Private Certificates

ACM supports both public and private certificate use cases:

• Public certificates: Used by internet-facing applications. ACM public certificates are signed by the AWS Public Certificate Authority and can be used to establish trust with public clients.
• Private certificates: Used within an organization or private network. ACM Private CA allows an organization to operate its own private certificate authority and issue certificates for internal services, devices, or applications.
• Imported certificates: Certificates issued by a third-party certificate authority can be imported into ACM for use with supported AWS services.

Domain Coverage

A certificate can cover:

• One fully qualified domain name, such as api.example.com
• Multiple names using Subject Alternative Names (SANs), such as api.example.com and app.example.com
• A wildcard domain, such as *.example.com

A wildcard generally covers one subdomain level. For example, *.example.com can cover api.example.com, but not api.internal.example.com.

Common AWS Integrations

ACM certificates integrate with several AWS services, including:

• Elastic Load Balancing, such as Application Load Balancers
• Amazon CloudFront
• AWS Elastic Beanstalk
• AWS Nitro Enclaves
• AWS CloudFormation

A common architecture is to terminate TLS at an Application Load Balancer using an ACM certificate. The load balancer then forwards requests to backend targets according to the application’s security and encryption requirements.

Exam-Relevant Takeaways

• Use ACM to provision and manage SSL/TLS certificates for encryption in transit.
• Use AWS KMS to create and control encryption keys, commonly for encryption at rest and application cryptographic operations.
• Use AWS CloudHSM when dedicated, customer-controlled hardware security modules are required for cryptographic key operations.
• ACM certificates can be public, private, or imported from an external certificate authority.
• ACM supports single-domain, multi-domain, and wildcard certificates.
• ACM integrates with services such as Elastic Load Balancing and CloudFront.
• Certificate management and key management are related but different responsibilities: a certificate contains identity information and a public key, while private keys must be protected and used for cryptographic operations.

Architecture Decision Guide

Requirement	Appropriate AWS capability
Enable HTTPS on an Application Load Balancer	ACM public certificate attached to the load balancer
Secure a CloudFront distribution with a custom domain	ACM certificate integrated with CloudFront
Automatically manage certificates for public application domains	ACM public certificates
Issue certificates for internal services or private devices	ACM Private CA
Continue using a certificate issued by an external CA	Import the certificate into ACM
Encrypt data at rest using centrally controlled keys	AWS KMS
Require dedicated HSM appliances and greater control over cryptographic operations	AWS CloudHSM

Common Exam Traps

• Choosing KMS for HTTPS certificates: KMS manages cryptographic keys, but it is not the normal service for provisioning public SSL/TLS certificates for load balancers or CloudFront.
• Confusing certificates with encryption keys: An ACM certificate supports identity verification and TLS negotiation. It is not interchangeable with a KMS key.
• Assuming all certificates are public: ACM Private CA is designed for private PKI use cases, including internal services that should not rely on public internet trust chains.
• Assuming wildcard coverage is unlimited: A wildcard such as *.example.com does not normally match deeper levels such as service.dev.example.com.
• Ignoring service integration requirements: ACM certificates are used with supported AWS services. The certificate must be requested or imported in the required AWS Region for the service; CloudFront commonly requires the certificate in us-east-1.
• Treating imported certificates exactly like ACM-issued certificates: Imported certificates can be used with supported services, but certificate renewal is not handled in the same way as ACM-managed public certificates. External certificates generally require an external renewal and reimport process.

Real-World Engineer Notes

• Prefer ACM-managed public certificates when possible because certificate issuance and renewal reduce operational overhead.
• Use DNS validation when managing public certificates for domains controlled through Amazon Route 53 or another DNS provider. DNS validation is generally easier to automate and maintain than manual email validation.
• Plan certificate deployment by Region. A certificate issued in one Region is not automatically available for regional resources in another Region.
• For CloudFront distributions, request or import the certificate in the AWS Region required by CloudFront rather than the Region hosting the origin.
• Decide deliberately where TLS terminates. Terminating at a load balancer reduces backend certificate management, but end-to-end encryption may still be required for compliance, zero-trust, or sensitive-data designs.
• Private CA introduces additional cost and operational responsibilities, including CA hierarchy design, certificate issuance policies, revocation, and trust distribution.

Quick Reference Summary

• ACM: SSL/TLS certificate issuance, storage, deployment, and renewal
• ACM public certificates: Publicly trusted certificates for internet-facing applications
• ACM Private CA: Private certificate authority and internal certificate issuance
• Imported certificates: Third-party certificates usable with supported AWS services
• Typical integrations: Elastic Load Balancing, CloudFront, Elastic Beanstalk, Nitro Enclaves, and CloudFormation
• KMS: Managed cryptographic keys, commonly used for encryption at rest
• CloudHSM: Dedicated hardware security modules for customer-controlled cryptographic operations
• Primary exam distinction: ACM protects communications in transit; KMS and CloudHSM manage cryptographic keys and operations

Flashcards

1. Q: What is the primary purpose of AWS Certificate Manager?

A: To provision and manage SSL/TLS certificates used primarily for encryption in transit.

1. Q: Which AWS service commonly provides HTTPS certificates for an Application Load Balancer?

A: AWS Certificate Manager.

1. Q: Can ACM certificates cover multiple domain names?

A: Yes. A certificate can use Subject Alternative Names to cover multiple domains.

1. Q: What does a wildcard certificate such as *.example.com cover?

A: Subdomains at one level beneath example.com, such as api.example.com.

1. Q: What is ACM Private CA used for?

A: Creating and operating a private certificate authority that issues certificates for internal or private use.

1. Q: Can certificates from an external certificate authority be used with AWS services?

A: Yes. Supported third-party certificates can be imported into ACM.

1. Q: Which service is generally selected for encryption keys used to encrypt data at rest?

A: AWS KMS.

1. Q: Which service provides dedicated hardware security modules?

A: AWS CloudHSM.

1. Q: Are ACM certificates automatically available in every AWS Region?

A: No. Certificates are Regional resources, with specific requirements for global services such as CloudFront.

1. Q: What is a major operational advantage of ACM-managed public certificates?

A: Eligible certificates can be automatically renewed, reducing manual certificate lifecycle work.

Practice Questions

Question 1

A company hosts an HTTPS application behind an Application Load Balancer. The security team wants AWS to issue and automatically renew the public certificate for www.example.com. Which solution meets the requirement with the least operational effort?

A. Create an AWS KMS key and attach it to the load balancer
B. Request an ACM public certificate and associate it with the HTTPS listener
C. Create a CloudHSM cluster and upload a private key to the load balancer
D. Store a certificate in Amazon S3 and configure the load balancer to retrieve it

Correct answer: B

Explanation: ACM provides public SSL/TLS certificates that integrate directly with Elastic Load Balancing and can handle renewal for eligible ACM-managed certificates. KMS and CloudHSM manage cryptographic keys, not the normal public certificate workflow for an Application Load Balancer.

Question 2

An enterprise needs to issue certificates for internal microservices. These certificates must be trusted only by applications and devices within the enterprise. Which solution is most appropriate?

A. ACM Private CA
B. An ACM public certificate with a wildcard name
C. AWS KMS asymmetric keys only
D. A CloudFront certificate

Correct answer: A

Explanation: ACM Private CA provides private PKI capabilities for issuing certificates intended for internal trust domains. A public ACM certificate is designed for publicly trusted names and does not replace a private certificate authority for internal PKI requirements.

Question 3

A company has a certificate issued by a preferred third-party certificate authority and wants to use it with an AWS load balancer. What should the architect recommend?

A. Import the certificate into ACM
B. Convert the certificate into a KMS key
C. Upload the certificate to an EC2 instance only
D. Use ACM Private CA to automatically adopt the third-party certificate

Correct answer: A

Explanation: ACM supports importing certificates issued by third-party certificate authorities for use with supported AWS services. The external CA remains responsible for issuing and renewing that certificate; the renewed certificate may need to be reimported.

Question 4

A solutions architect must select an AWS service for encrypting sensitive objects in Amazon S3 at rest. The architect also needs HTTPS for clients connecting to the application. Which combination is correct?

A. ACM for S3 encryption and CloudHSM for HTTPS
B. KMS for S3 encryption and ACM for HTTPS certificates
C. ACM for both S3 encryption and HTTPS
D. CloudFront for S3 encryption and KMS for HTTPS certificates

Correct answer: B

Explanation: AWS KMS supplies customer-controlled encryption keys commonly used for S3 server-side encryption. ACM supplies SSL/TLS certificates used to secure client connections through HTTPS.

Question 5

A company uses CloudFront with a custom domain and wants to attach an ACM certificate. In which Region should the certificate be requested for CloudFront?

A. The Region where users are located
B. The Region where the origin is hosted
C. us-east-1
D. Every Region where the distribution has an edge location

Correct answer: C

Explanation: ACM certificates used with Amazon CloudFront must be requested or imported in the US East (N. Virginia) Region, us-east-1, even when the origin is deployed elsewhere.