AWS ACM vs. Internal CLM: They Solve Different Problems
“We use AWS ACM for our certificates.”
This statement appears in every third enterprise security conversation. It’s usually followed by: “We don’t need a CLM platform because ACM handles certificate management automatically.”
Both statements can be true simultaneously — and neither addresses the actual problem. AWS ACM is an excellent service that solves a specific, narrow problem extremely well. It provides free, auto-renewing TLS certificates for AWS resources. That’s genuinely valuable.
But ACM’s scope is precisely defined and deliberately limited. It manages certificates for Application Load Balancers, CloudFront distributions, API Gateway endpoints, and a handful of other AWS-integrated services. It does not manage — and cannot manage — the 60-80% of enterprise certificates that exist outside that scope.
This post maps exactly what ACM covers, what it doesn’t, where organizations get surprised, and how to architect certificate management for hybrid environments where ACM is one component (not the whole solution).
What ACM Actually Does
AWS Certificate Manager provides two distinct services:
ACM Public Certificates (Free)
| Feature | Details |
|---|---|
| Certificate type | Domain Validated (DV) only |
| Cost | $0 (included with AWS services) |
| Validation methods | DNS validation, email validation |
| Auto-renewal | Yes — 60 days before expiry, automatic |
| Key storage | AWS-managed (you never access the private key) |
| Supported algorithms | RSA 2048, ECDSA P-256 |
| Maximum SANs | 10 per certificate |
| Wildcard support | Yes |
| Certificate transparency | Yes (logged to CT logs) |
| Deployment targets | ALB, NLB, CloudFront, API Gateway, Elastic Beanstalk, Amplify |
| Exportable | No (private key never leaves AWS) |
| Usable on EC2 directly | No (cannot install on instances) |
ACM Private CA (AWS Private Certificate Authority)
| Feature | Details |
|---|---|
| Certificate type | Any (server, client, device, code signing) |
| Cost | $400/month per CA + $0.75 per certificate issued |
| Validation | No domain validation (private CA, you control trust) |
| Auto-renewal | For ACM-issued private certs, yes |
| Key storage | AWS-managed HSM (FIPS 140-2 Level 3) |
| Supported algorithms | RSA 2048/4096, ECDSA P-256/P-384 |
| Certificate profiles | End-entity, subordinate CA, OCSP signing |
| CRL distribution | S3-hosted CRL |
| OCSP | Built-in OCSP responder |
| Exportable | Yes (with private key if requested) |
| Cross-account sharing | Yes (via RAM) |
What ACM Gets Right
ACM’s design philosophy is correct: certificates that protect AWS resources should be managed by AWS. No human should manually renew an ALB certificate. ACM eliminates an entire category of operational failure for cloud-native workloads.
For organizations running 100% of their workload on AWS with only public-facing services behind ALBs and CloudFront — ACM might genuinely be sufficient. This describes approximately 5-10% of enterprises.
What ACM Does NOT Do
This is where the “we use ACM” assumption breaks down:
| Capability | ACM Public | ACM Private CA | Enterprise CLM |
|---|---|---|---|
| Certificates for on-premises servers | ✗ | Possible (export) | ✓ |
| Certificates for non-AWS clouds (Azure, GCP) | ✗ | Possible (export) | ✓ |
| Internal PKI certificate management | ✗ | Partial | ✓ |
| VPN gateway certificates (non-AWS) | ✗ | ✗ | ✓ |
| Client authentication certificates | ✗ | ✓ (issuance only) | ✓ (lifecycle) |
| Code signing certificates | ✗ | ✓ (issuance only) | ✓ (lifecycle) |
| S/MIME email certificates | ✗ | ✗ | ✓ |
| Device identity certificates (IoT) | ✗ | ✓ (via IoT Core) | ✓ |
| OV/EV certificates | ✗ | N/A (private CA) | ✓ (via commercial CA) |
| Certificate discovery (find unknown certs) | ✗ | ✗ | ✓ |
| Multi-CA management | ✗ | Single CA hierarchy | ✓ |
| AD CS integration | ✗ | ✗ | ✓ |
| Network appliance certificates (F5, Citrix) | ✗ | ✗ | ✓ |
| Kubernetes cert-manager integration | ✗ | ✓ (as issuer) | ✓ |
| Compliance reporting (ISO, SOC, PCI) | ✗ | Basic (CloudTrail) | ✓ |
| Certificate on EC2 instances (installed) | ✗ | ✓ (export + deploy manually) | ✓ (automated) |
| Certificates for third-party SaaS | ✗ | ✗ | ✓ (manual or API) |
| Alerting with escalation chains | ✗ (basic EventBridge) | ✗ (basic EventBridge) | ✓ |
| Cross-cloud certificate inventory | ✗ | ✗ | ✓ |
AWS ACM Coverage vs. Total Certificate Estate
What ACM manages vs. what a typical enterprise actually needs
5%
Covered by ACM
95%
Needs separate management
The Coverage Gap: ACM vs. Your Actual Certificate Estate
A typical enterprise with AWS as primary cloud still has significant certificate needs outside ACM’s scope:
| Certificate Category | Typical Count (500-person company) | ACM Coverage |
|---|---|---|
| ALB/CloudFront certificates | 15-30 | ✓ Fully covered |
| EC2 instance certificates (web servers) | 20-50 | ✗ Not covered |
| Internal microservice mTLS | 50-200 | Partial (Private CA) |
| VPN gateway (Cisco, Palo Alto, Fortinet) | 5-15 | ✗ Not covered |
| Active Directory CS issued | 200-2,000+ | ✗ Not covered |
| On-premises applications (legacy) | 30-100 | ✗ Not covered |
| Azure resources (if hybrid) | 10-40 | ✗ Not covered |
| Code signing certificates | 3-10 | ✗ Not covered |
| S/MIME user certificates | 50-500 | ✗ Not covered |
| Client VPN user certificates | 50-200 | ✗ Not covered |
| Network equipment (switches, APs) | 20-100 | ✗ Not covered |
| Database TLS certificates | 10-30 | ✗ Not covered (RDS uses ACM, self-managed DBs don’t) |
| RADIUS/802.1X certificates | 5-15 | ✗ Not covered |
| IoT device certificates | 100-10,000+ | Partial (IoT Core) |
| Total certificates | 570-13,290 | 15-30 covered (2-5%) |
For most hybrid enterprises, ACM covers 2-5% of total certificate volume. It covers the certificates that matter most in the cloud — but “cloud certificates are handled” leaves 95% of the problem unsolved.
Where Organizations Get Surprised
Surprise 1: “We can’t use ACM certificates on EC2”
ACM public certificates cannot be exported. The private key never leaves AWS’s managed infrastructure. This means you cannot install an ACM certificate on:
- Nginx or Apache running on EC2
- Self-managed Kubernetes clusters on EC2
- Application servers that terminate TLS directly
- Custom TCP services that need TLS
Workaround: Use ACM Private CA to issue exportable certificates, or use certbot/Let’s Encrypt on EC2 instances directly.
Surprise 2: “ACM doesn’t know about our on-premises certificates”
ACM has zero visibility into certificates that weren’t issued through ACM. If you have 500 certificates issued by AD CS, DigiCert, or Sectigo running on-premises, ACM doesn’t track them, alert on them, or manage their renewal.
Impact: The comfort of “ACM handles our certs” creates a blind spot for the majority of the certificate estate.
Surprise 3: “ACM auto-renewal failed silently”
ACM auto-renewal requires the original validation method to still work. DNS validation requires the CNAME record to remain in place. If someone removes the validation CNAME (common during DNS migrations), auto-renewal fails.
ACM emits CloudWatch events for renewal failure, but if nobody configured alerting on those events, the failure is silent until the certificate expires and the ALB starts serving errors.
// EventBridge rule for ACM renewal failure (often not configured)
{
"source": ["aws.acm"],
"detail-type": ["ACM Certificate Approaching Expiration"],
"detail": {
"DaysToExpiry": [45, 30, 15, 7, 3, 1]
}
}Surprise 4: “ACM Private CA costs add up fast”
At $400/month per CA plus $0.75 per certificate, an organization issuing 1,000 certificates from a Private CA pays:
- CA operation: $4,800/year
- Certificate issuance (1,000 certs): $750/year (one-time)
- Renewal (1,000 certs annually): $750/year
- Total: ~$6,300/year for the CA alone
A multi-CA hierarchy (root + 2-3 subordinates) costs $19,200-$24,000/year just for CA operation before any certificates are issued.
Surprise 5: “We can’t get OV/EV certificates from ACM”
ACM issues only Domain Validated (DV) certificates. If your organization requires Organization Validated (OV) or Extended Validation (EV) certificates for compliance, customer-facing trust, or regulatory requirements, ACM cannot provide them.
Impact: Payment processing pages, financial applications, and government-facing services often require OV/EV certificates that must come from a commercial CA outside ACM.
Surprise 6: “ACM certificates aren’t in our compliance inventory”
ACM manages certificates within AWS, but it doesn’t generate the compliance reports auditors expect. An auditor asking “show me your certificate inventory” expects a unified view across all environments — not a screenshot of the ACM console for the cloud portion.
ACM + AD CS Coexistence: The Hybrid Reality
Most enterprises with significant AWS usage still run Active Directory Certificate Services (AD CS) for internal PKI. These two systems serve different purposes and manage different certificate populations:
AD CS Scope (Internal PKI)
| Use Case | Certificate Type | Volume |
|---|---|---|
| Domain controller authentication | Kerberos, LDAPS | Per DC (5-50) |
| Employee device certificates | 802.1X, VPN | Per device (hundreds-thousands) |
| Internal web applications | Server authentication | Per app (50-500) |
| Code signing (internal) | Code integrity | Per team/service (10-50) |
| SCCM/endpoint management | Client auth | Per managed device |
| SQL Server encryption | TLS for databases | Per instance (10-100) |
| RADIUS/NPS certificates | Server auth for NAC | Per NPS server (5-20) |
ACM Scope (Cloud TLS)
| Use Case | Certificate Type | Volume |
|---|---|---|
| Public-facing web applications | ALB TLS termination | Per ALB listener (15-30) |
| CDN distribution | CloudFront TLS | Per distribution (5-15) |
| API Gateway endpoints | Custom domain TLS | Per API (5-20) |
The Gap Between Them
| Attribute | AD CS | ACM | Neither (Gap) |
|---|---|---|---|
| Internal server TLS (non-AWS) | ✓ | ✗ | — |
| Cloud load balancer TLS | ✗ | ✓ | — |
| EC2 instance TLS | ✗ | ✗ | ✓ Manual/certbot |
| Hybrid cloud (Azure/GCP) | ✗ | ✗ | ✓ Need separate solution |
| Multi-cloud mTLS | ✗ | ✗ | ✓ Need separate solution |
| SaaS custom domain certs | ✗ | ✗ | ✓ Manual upload |
| On-prem-to-cloud mTLS | Partial | Partial | ✓ Architecture needed |
| Unified certificate inventory | ✗ | ✗ | ✓ CLM fills this gap |
Architecture Patterns for Hybrid Certificate Management
Pattern 1: ACM-Primary (Cloud-Native Organizations)
Best for: Organizations with 80%+ workload on AWS, minimal on-premises footprint.
┌─────────────────────────────────────────────────┐
│ AWS Environment │
│ │
│ ACM Public ─── ALB, CloudFront, API Gateway │
│ │
│ ACM Private CA ─── EC2 mTLS, ECS services, │
│ Lambda mTLS │
│ │
│ cert-manager ─── EKS pod certificates │
│ (with ACM PCA issuer) │
│ │
└─────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────┐
│ Small On-Premises Footprint │
│ │
│ Let's Encrypt/certbot ─── Public-facing VPN │
│ AD CS ─── Domain controllers, internal only │
│ │
│ CLM Platform ─── Unified visibility across all │
└─────────────────────────────────────────────────┘Pattern 2: Hybrid-Balanced (Traditional Enterprise + Cloud)
Best for: Organizations with significant on-premises and cloud infrastructure (most enterprises).
┌────────────────────────────────────────────────────────┐
│ Certificate Lifecycle Management Platform (Unified) │
│ - Discovery across all environments │
│ - Alerting for all certificate types │
│ - Compliance reporting (consolidated) │
│ - Ownership tracking │
└───────────────────┬────────────────────────────────────┘
│
┌───────────┼───────────────────┐
│ │ │
▼ ▼ ▼
┌──────────────┐ ┌──────────────┐ ┌──────────────────┐
│ AWS │ │ On-Premises │ │ Azure/GCP │
│ │ │ │ │ │
│ ACM Public │ │ AD CS │ │ Azure Key Vault │
│ ACM PCA │ │ (internal) │ │ GCP Cert Manager │
│ │ │ │ │ │
│ Let's Encrypt│ │ DigiCert │ │ Let's Encrypt │
│ (EC2) │ │ (public) │ │ (VMs) │
└──────────────┘ └──────────────┘ └──────────────────┘Pattern 3: Enterprise-Governed (Large, Regulated Organizations)
Best for: Financial services, healthcare, government — strict governance, multiple PKI hierarchies.
┌─────────────────────────────────────────────────────────────┐
│ Enterprise CLM Platform (Venafi/Keyfactor/equivalent) │
│ - Policy engine governing all certificate issuance │
│ - HSM-backed key management │
│ - Approval workflows per certificate class │
│ - Compliance automation (PCI, SOC, ISO, HIPAA) │
│ - PQC readiness tracking │
└────────────┬──────────────────────┬─────────────────────────┘
│ │
┌────────┴────────┐ ┌───────┴───────────────────┐
│ Cloud CAs │ │ Enterprise CAs │
│ │ │ │
│ ACM Public │ │ AD CS (multi-forest) │
│ ACM PCA │ │ DigiCert/Entrust (public) │
│ Azure Key Vault │ │ Internal root CA (HSM) │
│ GCP PCA │ │ Venafi-issued (private) │
└─────────────────┘ └────────────────────────────┘When ACM Is Sufficient (Honest Assessment)
ACM alone is sufficient when ALL of these conditions are true:
| Condition | Requirement |
|---|---|
| 100% AWS workload | No on-premises, no other clouds |
| Public-facing only | No internal PKI, no mTLS between services |
| ALB/CloudFront termination only | No TLS on EC2 instances directly |
| DV certificates acceptable | No OV/EV requirements |
| No VPN certificates | No Cisco, Palo Alto, Fortinet requiring certs |
| No client certificates | No user/device cert-based authentication |
| No code signing | No internal code signing requirements |
| Simple compliance | No PCI, SOC 2, or ISO certificate inventory requirement |
| Small scale | Under 50 certificates total |
If even one condition is false, ACM needs supplementation.
Reality Check
The percentage of 500+ person enterprises where ALL conditions are true: approximately 3-5%. Startups and small SaaS companies often qualify. Traditional enterprises almost never do.
Common “We Use ACM” Conversations
The Security Architect’s Concern
CISO: “Do we manage our certificates properly?” Cloud Team: “Yes, ACM handles all our certificates automatically.” CISO: “What about the VPN? The AD CS certificates? The code signing certs?” Cloud Team: “…those aren’t our responsibility.” CISO: “They’re still our certificates.”
The Auditor’s Question
Auditor: “Show me your certificate inventory.” Team: (shows ACM console with 25 certificates) Auditor: “And the certificates on your on-premises servers?” Team: “Those are managed by the infrastructure team.” Auditor: “Show me that inventory.” Team: ”…”
The Incident Response
Incident: Customer-facing payment portal shows certificate error. Team: “But ACM handles our certs…” Root cause: The certificate was on an EC2 instance running nginx, not behind an ALB. ACM never managed it. Nobody renewed it.
Integrating ACM with Enterprise Certificate Management
Option 1: ACM as a Managed CA Within CLM
Configure your CLM platform to monitor ACM certificates alongside everything else:
- Pull ACM certificate inventory via AWS API
- Monitor ACM renewal events via EventBridge
- Include ACM certificates in unified compliance reports
- Alert if ACM renewal fails (DNS validation CNAME removed)
# Example: Pull ACM certificate inventory for CLM integration
import boto3
from datetime import datetime, timezone
def get_acm_certificates(region='us-east-1'):
"""Retrieve all ACM certificates for CLM inventory integration."""
client = boto3.client('acm', region_name=region)
paginator = client.get_paginator('list_certificates')
certificates = []
for page in paginator.paginate(
CertificateStatuses=['ISSUED', 'PENDING_VALIDATION', 'EXPIRED']
):
for cert_summary in page['CertificateSummaryList']:
cert_detail = client.describe_certificate(
CertificateArn=cert_summary['CertificateArn']
)['Certificate']
certificates.append({
'arn': cert_detail['CertificateArn'],
'domain': cert_detail['DomainName'],
'sans': cert_detail.get('SubjectAlternativeNames', []),
'status': cert_detail['Status'],
'issuer': cert_detail.get('Issuer', 'Amazon'),
'not_after': cert_detail.get('NotAfter'),
'renewal_status': cert_detail.get('RenewalSummary', {}).get('RenewalStatus'),
'in_use_by': cert_detail.get('InUseBy', []),
'type': cert_detail['Type'], # 'AMAZON_ISSUED' or 'IMPORTED'
'key_algorithm': cert_detail.get('KeyAlgorithm'),
'source': 'aws-acm',
'managed': True if cert_detail['Type'] == 'AMAZON_ISSUED' else False
})
return certificates
def check_renewal_health(certificates):
"""Identify ACM certificates with renewal issues."""
issues = []
now = datetime.now(timezone.utc)
for cert in certificates:
# Check for failed renewals
if cert.get('renewal_status') == 'FAILED':
issues.append({
'severity': 'CRITICAL',
'cert': cert['domain'],
'issue': 'ACM auto-renewal failed',
'action': 'Check DNS validation CNAME records'
})
# Check for imported certs approaching expiry (ACM won't auto-renew)
if not cert['managed'] and cert.get('not_after'):
days_left = (cert['not_after'] - now).days
if days_left < 30:
issues.append({
'severity': 'HIGH',
'cert': cert['domain'],
'issue': f'Imported certificate expires in {days_left} days',
'action': 'Manual renewal required (not auto-renewed by ACM)'
})
return issuesOption 2: ACM Private CA as Issuer for cert-manager
For Kubernetes environments, ACM Private CA can serve as the certificate issuer while cert-manager handles lifecycle:
# cert-manager AWS PCA Issuer configuration
apiVersion: awspca.cert-manager.io/v1beta1
kind: AWSPCAClusterIssuer
metadata:
name: aws-pca-issuer
spec:
arn: arn:aws:acm-pca:us-east-1:123456789:certificate-authority/abc-123
region: us-east-1
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-api
namespace: production
spec:
secretName: internal-api-tls
duration: 720h
renewBefore: 360h
issuerRef:
name: aws-pca-issuer
kind: AWSPCAClusterIssuer
group: awspca.cert-manager.io
dnsNames:
- api.internal.example.com
usages:
- server auth
- client authOption 3: EventBridge Integration for ACM Monitoring
{
"EventPattern": {
"source": ["aws.acm"],
"detail-type": [
"ACM Certificate Approaching Expiration",
"ACM Certificate Expired"
]
},
"Targets": [
{
"Arn": "arn:aws:sns:us-east-1:123456789:cert-alerts",
"Id": "cert-alert-topic"
},
{
"Arn": "arn:aws:lambda:us-east-1:123456789:function:cert-inventory-sync",
"Id": "sync-to-clm"
}
]
}Recommendations by Organization Profile
| Profile | ACM Role | Additional Tooling Needed |
|---|---|---|
| Cloud-native startup (< 200 people) | Primary cert management | certbot for EC2, basic monitoring |
| SaaS company (200-1,000 people) | Cloud certs only | Mid-market CLM for non-ACM certs |
| Enterprise (hybrid cloud + on-prem) | One CA among many | Enterprise CLM as unified platform |
| Regulated enterprise (finance, health) | One CA among many, governed | Enterprise CLM with policy engine |
| Multi-cloud organization | AWS-specific only | Cross-cloud CLM required |
The Takeaway
AWS ACM is not a certificate management strategy. It’s a certificate automation feature for AWS resources. Building your certificate management plan around “we use ACM” is like building your backup strategy around “EC2 instances have EBS volumes.” It’s true, it’s relevant, and it covers about 10% of the problem.
The remaining 90% — internal PKI, VPN certificates, device authentication, code signing, on-premises infrastructure, multi-cloud deployments — requires a certificate lifecycle management approach that sees across all environments and manages all certificate types.
ACM should be a data source feeding into that approach, not a replacement for it.
About QCecuring
QCecuring integrates with AWS ACM, Azure Key Vault, GCP Certificate Manager, AD CS, and commercial CAs to provide unified certificate visibility. We don’t replace ACM — we complement it by covering the 90% of certificates that ACM was never designed to manage.
One dashboard. All certificates. Every environment.
See your full certificate estate →
Tags: AWS ACM, Certificate Management, Cloud Security, Hybrid Cloud, Internal PKI, AD CS, Certificate Lifecycle Management, CLM, AWS Private CA, Multi-Cloud, Certificate Inventory, Enterprise Security, TLS, VPN Certificates