On AWS, the recommended path is requesting a certificate through AWS Certificate Manager (ACM) rather than uploading a manually generated one — ACM handles renewal automatically for certificates used with an ALB.
- In ACM, request a public certificate for your domain, validating ownership via DNS (a CNAME record ACM provides) or email.
- Once issued, go to your Application Load Balancer's listener settings, add or edit the HTTPS (443) listener, and select the ACM certificate from the dropdown.
- Confirm your security policy (TLS version/cipher suite selection) meets your requirements — AWS provides several predefined policies to choose from.
Because ACM manages renewal automatically for certificates actively used by supported AWS services, there's no manual renewal step required as long as DNS validation records remain correctly in place.
What to do if your ACM certificate is stuck in pending validation
A certificate stuck in pending validation almost always means the required DNS validation record hasn't been added correctly, or hasn't yet propagated — confirming the exact CNAME record ACM specifies is correctly added to your DNS, and allowing time for propagation, resolves the large majority of stuck validations.
How to attach multiple certificates to a single ALB for different domains
An ALB's HTTPS listener supports multiple certificates through SNI, allowing you to serve different certificates for different hostnames from one load balancer — additional certificates beyond the default one are added directly through the listener's certificate configuration in the AWS console or CLI.
What happens to ACM certificates when the associated Route 53 hosted zone changes
If you migrate DNS management away from Route 53 after using it for ACM's DNS validation, the validation CNAME record needs to be recreated in your new DNS provider to allow future automatic renewal — ACM's renewal depends on continued ability to validate ownership through that same DNS mechanism.
How ALB certificate rotation works without any listener downtime
Adding a renewed or replacement certificate to an ALB listener, then removing the old one, can be done without any listener downtime, since the ALB continues serving existing connections with whichever certificate was active when they were established while new connections use the updated certificate.
Why CloudFront in front of an ALB needs its own separate certificate configuration
If CloudFront sits in front of your ALB as a CDN layer, CloudFront requires its own certificate (also typically via ACM, though in the us-east-1 region specifically for CloudFront) independent of whatever certificate is configured directly on the ALB itself.
What Security Groups need to allow for your ALB to function correctly with HTTPS
Beyond the certificate and listener configuration itself, your ALB's associated Security Group needs to explicitly allow inbound traffic on port 443 — a correctly configured certificate and listener won't matter if the underlying network security group is still blocking the actual HTTPS traffic.
How to monitor ACM certificate expiry even though renewal is normally automatic
While ACM handles renewal automatically for DNS-validated certificates as long as validation records remain in place, CloudWatch can be configured to alert on a certificate's days-until-expiry metric, providing a safety net in case something disrupts the normally automatic renewal process.
A closing note on AWS's broader philosophy toward managed certificate infrastructure
ACM's tight integration with ALB reflects AWS's broader platform philosophy of abstracting infrastructure management wherever reasonable — a meaningful convenience once you're operating within AWS's ecosystem, though worth understanding the underlying mechanics covered in this guide for the rare occasion something needs deeper troubleshooting.
A final practical tip for organizing certificates at scale
Tagging your ACM certificates with meaningful names and associated application identifiers, consistent with your broader AWS resource tagging strategy, makes certificate management considerably easier to audit as your infrastructure grows across more services and environments.