1.3 KiB
Amazon Certificate Manager
Provisions, manages, and deploys public and private SSL/TLS certificate for use with AWS Services.
ACM handles the complexity of creating and managing public SSL/TLS certificates for your AWS based websites and applications.
ACM handles two kinds of certificates:
- Public - Certificates provided by ACM (Free)
- Privates - Certificates you import ($400 / month)
ACM can handle multiple subdomains and wildcard domains (*.example.com).
ACM can be attached to the following AWS resources:
- ELB
- _CloudFront
- API Gateway
- _Elastic BeanStalk (through ELB)
Types
Terminating SSL at Load Balancer
All traffic in-transit beyond the ALB is unencrypted
You can add as many EC2 instances to the ALB as you need, and you don't need to install certificates on each instances. Less secure, in theory, if someone can grab the data in between the ALB and EC2 instances.
Terminating SSL End-to-End
Traffic is encrypted in-transit all the way to the application.
It guarantees encryption is end to end. It's more complicated to maintain certificates. You can't do this with ACM by itself. You can set up Let's Encrypt for it.