Using a Paid SSL Certificate on AWS (ACM Import, EC2, Load Balancers, CloudFront)

An AWS SSL certificate comes from one of two places. Either AWS Certificate Manager (ACM, Amazon’s certificate service) issues a domain-validated certificate for you, or you buy a certificate from a certificate authority and import it into ACM or install it on your own server. The free ACM route works well for load balancers and CloudFront. You need a purchased certificate when you want organization or extended validation, TLS on an EC2 instance itself, or one certificate across AWS and other platforms.

Key fact	As of October 2026
ACM public certificates (standard)	No charge when used with ACM-integrated services; private key never leaves AWS
Validation level from ACM	Domain validation (DV) only
ACM certificate validity	198 days (default since February 2026)
Imported certificates	Any publicly trusted DV, OV or EV certificate in PEM format; you renew and reimport
CloudFront region	Request or import the certificate in US East (N. Virginia), us-east-1

Yes, standard public certificates from ACM cost nothing, but only when you use them with ACM-integrated services such as Elastic Load Balancing and CloudFront. You cannot download the private key of a standard ACM certificate, so you cannot install it on an EC2 web server or anywhere outside AWS.

Since June 2025, ACM also offers exportable public certificates. You can export these with their private key and use them on EC2, in containers or on-premises. AWS charges for them per domain name, so check the current price on the AWS pricing page. They are still domain validated only.

So “free” depends on where TLS ends. If it ends at a load balancer or CloudFront and DV is enough, ACM is the simplest answer. For a wider look at the trade-offs, read our guide to free vs paid SSL.

Your four certificate options on AWS

Option	Validation	Where you can use it	Private key	Renewal
ACM public certificate	DV	ACM-integrated services only	Stays in AWS	Automatic by ACM
ACM exportable certificate	DV	Anywhere, incl. EC2	You export it	You redeploy each new certificate
Purchased, imported into ACM	DV, OV or EV	Load balancers, CloudFront and other integrated services	You hold it	You renew and reimport
Purchased, installed on EC2	DV, OV or EV	Your own web server	You hold it	You renew and reinstall

What an AWS SSL certificate really costs

The price tag is only part of the cost. A standard ACM certificate renews itself, so your team spends no time on it. An imported or EC2-installed certificate needs a person or a script to replace it before every expiry. With lifetimes capped at 200 days today, that happens about twice a year per certificate. Count that work when you compare the ACM route with a purchased certificate, and automate the reimport where you can.

For public-facing business sites, an organization validated (OV) SSL certificate is the usual step up from ACM. The certificate authority checks that your company exists, and anyone who opens the certificate details sees the verified organization name. Encryption strength is the same for DV, OV and EV; the difference is the identity check behind the certificate.

How to import a purchased AWS SSL certificate into ACM

Importing puts your own certificate into ACM so that load balancers, CloudFront and other integrated services can use it. You generate the key, the certificate authority validates you and issues the certificate, and you paste three PEM blocks into ACM.

If you still need the CSR, our CSR generator explains each field, including the common name. ACM rejects imports that miss its format rules, so check these before you paste:

ACM requirement	What it means for you
PEM encoding	Certificate, key and chain must be Base64 PEM text; DER files fail
Unencrypted private key	Remove the passphrase first; the key may be no larger than 5 KB
Chain in order	Intermediates only, starting with the one that signed your certificate; leave out the root
Valid at import time	You cannot import before the start date or after the expiry date
Supported keys	RSA 1024–4096 bit or ECDSA P-256/P-384/P-521; each service accepts a subset

Most failed imports come down to a wrong or incomplete intermediate bundle. Our guide to the certificate chain shows how intermediates and roots fit together.

Tip: ACM does not renew imported certificates. Put the expiry date in your calendar, and with CloudFront reimport the renewed certificate at least 24 hours before the old one expires. Your BUY-SSL plan term covers reissues, but each issued certificate follows the current maximum lifetime of 200 days, so plan for a reimport roughly twice a year.

Elastic Load Balancing (ALB and NLB)

Add an HTTPS (or TLS) listener and pick your imported certificate from ACM as the default certificate. The certificate must be in the same region as the load balancer. You can attach additional certificates to the same listener when you serve several hostnames.

CloudFront SSL certificate

CloudFront only reads certificates stored in ACM in us-east-1, whatever region your origin runs in. Every alternate domain name you add to the distribution must appear in the certificate’s subject alternative names, either exactly or through a wildcard at the same level. Certificates on your custom origin must come from a certificate authority on Mozilla’s included CA list.

Amazon S3 static websites

S3 website endpoints do not support HTTPS at all. To serve an S3-hosted site on your own domain over HTTPS, put CloudFront (or AWS Amplify Hosting) in front of the bucket and attach the certificate there.

Wildcard SSL certificates on AWS

ACM issues and accepts wildcard certificates. A wildcard covers one subdomain level, so *.example.com protects shop.example.com but not eu.shop.example.com. ACM wildcards do not include the bare domain; add example.com as a second name.

On EC2 you install the certificate in the web server software running on the instance, such as Apache, Nginx or IIS, not in an AWS console. Standard ACM certificates cannot be used here because you never get their private key.

1. Copy the certificate, the intermediate bundle and the private key to the instance with restricted file permissions.
2. Point your web server configuration at those files and enable port 443.
3. Open inbound TCP 443 in the instance’s security group.
4. Reload the web server and test the site from outside AWS.

The exact directives differ per server. Our guide on how to install an SSL certificate covers Apache, Nginx and IIS step by step. If a load balancer sits in front of your instances, you can terminate TLS there with an imported certificate instead and keep the instances simpler.

Running several instances behind DNS without a load balancer? Each instance needs the same certificate and key, so copy the files to every server and replace them on all of them at renewal. Check the product terms for how many servers a certificate may run on, and keep a list of every instance that holds the key so none is missed.

Databases work differently. Amazon RDS, Aurora and DocumentDB install and rotate their own server certificates, signed by AWS-managed certificate authorities such as rds-ca-rsa2048-g1. You do not buy or import a certificate for them.

Your job is on the client side: download the AWS certificate bundle (global-bundle.pem) and tell your database driver to verify the server against it. DocumentDB clusters have TLS enabled by default, so connection strings usually need tls=true and the bundle path.

Tip: Mixing approaches is normal. Many teams use free ACM certificates on internal load balancers and a purchased OV or EV certificate on the public site that customers see.