Lecture 239: AWS Certificate Manager (ACM)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：11:32
- 来源：Udemy Lecture 42734234
- Slide 数量：7
- 画面切换：02:58、06:09、07:11、08:58、10:20、10:52
扫描说明
逐条读取了 Transcript 面板中的 173 条英文 cue，并按播放器进度同步全长约 11:32 的视频。依据 TLS Trust、Public ACM vs Private CA、Supported Termination、Integration/Region、Wildcard/Trust、Renewal、Import/Private Key 划分为 7 个小节。Udemy 购券插屏一度覆盖播放器，已通过课程项重载恢复；7 张遮挡图全部作废并从真实 Slide 重截，最终均为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. HTTPS 依靠 X.509 Certificate 与受信 CA 证明 Server Authenticity
时间范围：00:00–02:58
总结 / Summary
中文
HTTP 以 Plaintext 传输，容易暴露 Credential 与 Transaction Data；HTTPS 在应用层通信下使用 TLS（历史上也称 SSL）建立加密 Channel。安全通信关注 Authenticity、Integrity 与 Privacy，本讲先聚焦 Authenticity：Server 保存与证书对应的 Private Key，Handshake 时把 X.509 Certificate 发给 Client；Certificate 声明 Domain Identity，并由 Client 已信任的 Certificate Authority 签名。Private Key 不离开 Server，CA Trust Chain 让 Client 能验证自己连接的是目标 Domain。ACM 的核心价值就是签发和管理这些 TLS Certificate。
English
HTTP sends data in plaintext, exposing credentials and transactions, while HTTPS uses TLS—historically called SSL—to establish an encrypted channel. Secure communication depends on authenticity, integrity, and privacy; this lecture first focuses on authenticity. The server keeps the certificate's private key and sends its X.509 certificate during the handshake. The certificate names the domain and is signed by a certificate authority already trusted by the client. The private key stays with the server, and the CA trust chain lets the client verify that it reached the intended domain. ACM issues and manages these TLS certificates.
Transcript
00:00 Hi.
00:01 In this lecture let's try to understand what is ACM and how does it help you to secure the network communication.
00:09 Now if you ever heard about the SSL that is secure socket layer or the TLS Transport Layer Security,
00:15 they provide the security to the layer seven traffic.
00:19 Right.
00:19 And to enable the SSL or TLS you need SSL X509 certificates and ACM provides those certificates.
00:27 So I hope you already aware of these concepts.
00:30 If not, I will just quickly talk about that and then we will see more about the ACM.
00:36 So very basic example I can give is the Http traffic.
00:40 And you know that you shouldn't transact if your bank website is Http or other, you shouldn't access
00:47 any website which is over Http.
00:49 That's because Http sends the traffic over the plaintext.
00:53 So if you are doing some transaction, your credentials can be easily hacked.
00:58 Right?
00:58 So this is not the great situation to be in.
01:01 So what do you do.
01:02 You turn to Https.
01:04 Now when you turn to Https it underlying using the SSL or TLS protocol to protect your communication.
01:12 So once you do that, all the communication goes over the encrypted channel.
01:17 And to make this communication secure there are three basic principle the authenticity the integrity
01:24 and the privacy of the communication.
01:26 But here let's just try to understand the authenticity because it is helpful to understand the concept
01:32 of SSL TLS certificates.
01:34 So authenticity means that client is talking to the right server.
01:39 So server has to prove that it is a legitimate server.
01:43 So how that happens.
01:44 So that happens through something called SSL or TLS certificate.
01:48 So server has that certificate.
01:50 And server also has corresponding private key which never leaves the server.
01:55 And the first time when client connects to the server the server will send this certificate back to
01:59 the client.
02:00 So now the question is client has the certificate.
02:04 And that certificate tells the client that it is communicating with the some bank.com.
02:08 But the question is why will client trust that certificate?
02:11 And for exactly that reason, this certificate has to be signed by someone to which this client also
02:18 trust.
02:18 And that's where certificate authority comes into the play.
02:21 So this some bank.com will first get this certificate signed by the certificate authority and now send
02:28 it to the client.
02:29 And client already trusts this CA.
02:32 Now how this happens and what all other steps are there to have the integrity and privacy in the communication.
02:38 I have explained this in very, very detail in my one of the video on the YouTube.
02:43 So if interested please go and watch that.
02:47 There is also link in the description of this channel for this YouTube video.
02:51 But as of now, our focus is only on this SSL certificate which ACM can provide you.
2. ACM Public Certificate 面向 Internet，AWS Private CA 构建内部 PKI
时间范围：02:58–06:09
总结 / Summary
中文
传统流程先生成 Public/Private Key Pair 和 CSR，CA 验证 Domain Ownership 后签发 Certificate；ACM 把 Public Certificate 申请、Domain Validation 和 AWS Service 部署简化为托管流程。Public ACM Certificate 供 Internet Client 普遍信任，主要挂载到 AWS Integrated Service。内部 VPC 的 Service-to-Service、Database、IoT、Client Authentication 或 Smart Card 场景可使用 Self-signed Certificate，或用 AWS Private CA 管理 Root/Subordinate CA、Validity、Revocation 与完整 PKI。Public ACM 与 Private CA 是不同产品和责任模型。
English
The traditional workflow generates a public and private key pair and CSR, then asks a CA to validate domain ownership and sign the certificate. ACM turns public-certificate requests, domain validation, and deployment to integrated AWS services into a managed workflow. Public ACM certificates are broadly trusted by Internet clients and are mainly attached to integrated AWS services. Internal VPC service-to-service, database, IoT, client-authentication, or smart-card use cases can use self-signed certificates or AWS Private CA for root and subordinate CAs, validity, revocation, and a complete PKI. Public ACM and Private CA are separate products with different responsibility models.
Transcript
02:58 Okay, so what's the typical process to get these SSL certificates.
03:03 So very first thing is you need to have your own domain name.
03:06 And you can buy this domain name from anyone like Globalsign or GoDaddy or even from Amazon route 53.
03:13 Once you buy the domain name, you need to request a certificate.
03:17 Now for that.
03:18 Typically, you will create a public key and a private key pair using open SSL, and then you will submit
03:24 the certificate signing request to the CA that is certificate authority.
03:29 The certificate authority will validate that you own the domain name and will sign that request and
03:34 issue you a certificate.
03:36 Now there are well known certificate authorities, but we will be talking about AWS Certificate Manager
03:42 here.
03:42 Now as you use AWS Certificate Manager, it's much simpler to get the certificate.
03:48 Basically you just request a public certificate and it will validate your domain ownership and it will
03:54 issue you the certificate.
03:56 Now one thing to understand here is that here we are talking about the public SSL or TLS certificate,
04:02 which means certificate which are trusted by all the clients, which connects to your application over
04:07 the internet.
04:08 But many a times you need the internal communication to be made secure.
04:14 For example, within your AWS VPCs there are a lot of machines like application server is talking to
04:20 the database or all other application server talking to each other.
04:24 Now this is all internal communication to the VPC.
04:27 Now in that case, you don't need to have the public SSL certificate, but rather you can have your
04:33 self-signed SSL certificate.
04:35 Or you can get this private certificate from AWS private CA, which is a different offering than the
04:43 ACM.
04:44 And in this lecture we are primarily focusing on the ACM.
04:48 That is public certificate part of the Amazon Certificate Manager.
04:52 So just to reiterate, there are two parts of the AWS Certificate Manager the ACM, which issues the
04:59 public certificate.
05:00 And this certificates can be deployed on AWS managed services, for example load balancers or CloudFront
05:07 or API gateways.
05:08 Likewise.
05:10 But for internal use you can use AWS private CA where you get much more control with respect to the
05:16 certificate validity.
05:17 The domain names the root CA, the subordinate CA, the revocation of the certificate, all that is
05:24 handled by you using AWS private CA and this is typically called the PKI.
05:30 That is public key infrastructure.
05:33 You can also use this private certificate as a client certificate.
05:36 That means you can issue this certificate into the smartcard.
05:40 And then employee can log in with their smart card into their system.
05:45 Or if you have IoT devices and you have mQTT endpoints, then also you can deploy this private certificate
05:52 to your IoT devices.
05:54 Now all these are the use cases of the private CA.
05:57 But in this lecture we are focusing on the ACM which issues the public certificate for your AWS managed
06:05 services.
06:06 So I hope this distinction is clear.
3. Public ACM Certificate 不能直接导出到 EC2，TLS Termination 放在 Integrated Service
时间范围：06:09–07:11
总结 / Summary
中文
本讲强调 ACM 签发的 Public Certificate 不能导出 Private Key 后直接安装到 EC2/ECS；若要在 Instance 内终止 TLS，需要自管或使用其他可导出的证书方案。典型做法是在 ALB/NLB、API Gateway、CloudFront、Elastic Beanstalk 等 ACM Integrated Service 上做 TLS Termination，再按安全需求以 HTTP 或重新加密的 HTTPS 连接 Backend。不要把“Backend 在 VPC 内”自动等同于可以明文：Compliance、Zero Trust、跨网段或敏感数据仍可能要求 End-to-End Encryption。
English
The lecture emphasizes that a public certificate issued by ACM cannot be exported with its private key and installed directly on EC2 or ECS. Terminating TLS inside an instance requires a self-managed or otherwise exportable certificate. The usual pattern terminates TLS on ACM-integrated services such as ALB or NLB, API Gateway, CloudFront, or Elastic Beanstalk, then connects to the backend over HTTP or re-encrypted HTTPS according to the security requirement. A backend being inside a VPC does not automatically justify plaintext; compliance, zero-trust boundaries, cross-segment paths, or sensitive data may still require end-to-end encryption.
Transcript
06:09 Okay, so in general when we talk about the AWS services where you can deploy these certificates.
06:16 So let's see that now the first one is you directly want to deploy your certificate on the EC2 machines.
06:22 Now ACM which provides a public certificate doesn't allow that because you can't export the ACM certificate
06:29 and deploy it on EC2 machines or ECS cluster.
06:33 If you want to do that, you have to use your self-signed certificates.
06:36 So this is out of scope for the ACM public certificates.
06:40 But if your workloads are behind the load balancer or API gateway or CloudFront or Beanstalk, and there
06:46 are more services which are called integrated services with the ACM, then you can get these certificates
06:53 and deploy that on any of these resources.
06:56 Now in this case, you can see the SSL termination happens over the load balancer.
07:01 And from the load balancer to the back end the traffic can be over simple Http.
07:05 It need not be encrypted because all these resources sits within the VPC.
4. Certificate 可一键挂载 AWS Service；ACM Regional，CloudFront 固定用 us-east-1
时间范围：07:11–08:58
总结 / Summary
中文
在 ALB 创建 HTTPS Listener 时可直接选择 ACM Certificate；CloudFront、API Gateway 等 Integrated Service 也采用类似关联方式。ACM 是 Regional Service，因此 Load Balancer 等区域资源必须使用其所在 Region 的 Certificate。CloudFront 是 Global Service，但其 Viewer Certificate 必须在 us-east-1（N. Virginia）请求或导入。ACM 还可申请 Wildcard，例如 *.example.com 覆盖同一级的 api.example.com 与 web.example.com，减少多个 Endpoint 分别维护证书。
English
An ALB HTTPS listener can select an ACM certificate directly, and integrated services such as CloudFront and API Gateway use similar associations. ACM is regional, so regional resources such as load balancers use certificates in their own region. CloudFront is global, but its viewer certificate must be requested or imported in us-east-1, Northern Virginia. ACM can also issue a wildcard such as *.example.com to cover same-level names including api.example.com and web.example.com, reducing per-endpoint certificate management.
Transcript
07:11 Okay.
07:11 So let's quickly talk about few features of the ACM.
07:15 And to be honest, the deep dive of ACM should be part of AWS security certification than the network
07:21 certification.
07:25 But let's here cover what is important for your network certification exam.
07:27 Right.
07:27 So ACM as you know, provides the SSL TLS certificates which you can deploy on this supported AWS services.
07:34 And this is very seamless.
07:35 For example, if you are using application load balancer you have to just create the Https listener.
07:40 And there it will show an option to import the certificate, which is created in the ACM.
07:47 You just apply that and that's it right?
07:49 Nothing else needs to be done.
07:50 Same for the CloudFront or API gateways.
07:53 Now you can also request the wildcard certificate.
07:56 For example you have your company domain name and then you can say API dot example.com or say web dot
08:04 example.com.
08:05 Instead of having multiple certificates, you can just have star dot example.com.
08:10 And same certificate can be applied for all those endpoints.
08:15 And just one thing that you need to remember is that whenever you are using your certificate for the
08:21 CloudFront service, which is a global service, you have to create this certificate in the US East,
08:27 one that is Northern Virginia region.
08:29 ACM is a regional service.
08:31 That means if you are using it for the load balancer, you have to create that certificate in that particular
08:37 region.
08:38 Right.
08:38 So just remember this small bit here.
08:42 And as you can see here, you have administrator who can issue the certificate through the ACM.
08:47 And then this certificate can be deployed to different AWS services.
08:51 And then users terminate their SSL connection on that endpoint.
08:56 Right.
08:56 So I hope that is clear.
5. Wildcard 只能放在最左标签，Public Trust 来自 Amazon Trust Services
时间范围：08:58–10:20
总结 / Summary
中文
Wildcard 必须是最左侧完整 Label：*.app.example.com 合法，而 app.*.example.com 或把 * 嵌进 Label 不合法；它也只匹配一个 Domain Level。ACM Public Certificate 由 Amazon Trust Services 的 Public CA Chain 签发，因此主流 Browser/Device 能通过其 Trusted Root 验证。Public ACM Certificate 用于支持的 AWS Service 时不单独收取证书费用；AWS Private CA 则是有成本、可自定义 CA Hierarchy 与 Certificate Policy 的独立服务。
English
A wildcard must be the complete leftmost label: *.app.example.com is valid, whereas app.*.example.com or embedding * inside a label is not. It also matches only one domain level. Public ACM certificates chain to Amazon Trust Services public CAs, allowing mainstream browsers and devices to validate them through trusted roots. Public ACM certificates used with supported AWS services do not carry a separate certificate charge, while AWS Private CA is a paid, separate service for custom CA hierarchies and certificate policies.
Transcript
08:58 Now a few more things and then we will wrap this session up.
09:02 So with ACM you know that you can have wild card certificate.
09:05 But wild card cannot be in the middle of the domain name.
09:08 So app dot star dot example.com is not allowed.
09:12 But star dot app dot example.com is allowed.
09:16 So remember this further all these certificates.
09:19 And here again we are talking about the public ACM certificates not the private CA.
09:24 All the certificates are signed by the AWS Trust Services CA.
09:30 So AWS has a well known certificate authority which is trusted by most of our browsers and the devices.
09:36 And that's where all these certificates, which are signed by the AWS root CAS, are automatically trusted
09:42 by all leading browsers like Chrome and Microsoft.
09:45 So you don't get that small warning that your certificate is not trusted because it is signed by AWS
09:53 Trusted Root CAS.
09:56 Further, the public certificate issued through ACM are valid for 13 months, but in case you need higher
10:02 validity or customize the certificates, then of course you need to go with the private CA which is
10:09 totally different entity.
10:10 And there is a lot of cost for the private CA.
10:13 The public certificate through ACM are free to use with all those supported AWS services.
6. Managed Renewal 依赖 Certificate 在用且 Validation 可持续完成
时间范围：10:20–10:52
总结 / Summary
中文
本讲 Slide 以录制时口径写 Public Certificate 有效期为 13 Months（395 Days）；Certificate Lifetime 属于会变化的 CA/Browser Policy，实际考试与部署应以当前 AWS 文档为准，核心不变量是让 ACM Managed Renewal 正常运行。DNS Validation 最适合持续自动验证；Email Validation 会在 Expiry 前开始通知并需要 Owner 响应。Certificate 必须仍关联到受支持的 AWS Resource，Validation Record/Contact 可用，才能避免 Renewal 失败和 TLS Outage。
English
The slide uses the recording-time value of 13 months, or 395 days, for public-certificate validity. Certificate lifetimes are subject to changing CA and browser policy, so current AWS documentation should be used for exams and deployments; the durable concept is keeping ACM managed renewal healthy. DNS validation best supports continuous automated validation, while email validation sends pre-expiration notices and requires owner action. The certificate must remain associated with a supported AWS resource and its validation record or contact path must remain usable to prevent renewal failures and TLS outages.
Transcript
10:20 Now for the renewal of the certificates.
10:22 ACM will automatically do that if you are using it on the Elbe and the CloudFront.
10:26 Likewise.
10:27 Right.
10:28 And it automatically renews that if you are using the domain validation method, if you are using email
10:33 validation, then it will start sending you the email about your expiration around 45 days before the
10:40 actual expiration of the certificate.
10:42 Then you have to take certain actions to renew your certificate.
10:46 But again here ACM will renew that just that you need to tell ACM to renew your certificate.
7. Imported Certificate 带入 Private Key，但 Renewal 责任仍在 Owner
时间范围：10:52–11:32
总结 / Summary
中文
若已有第三方 CA 签发的 Certificate，可把 Certificate、Certificate Chain 与对应 Private Key 导入 ACM，再关联到支持的 AWS Resource 做 TLS Termination。它与 ACM-issued Public Certificate 的边界不同：ACM 自己签发时不会向用户暴露 Private Key；Import 时 Owner 主动提供 Private Key。Imported Certificate 不享受 ACM-issued Certificate 的自动 Renewal，Owner 必须监控 Expiration、向原 CA Renew/Reissue，并在到期前重新导入和替换关联。
English
An existing certificate from another trusted CA can be imported into ACM with its certificate chain and corresponding private key, then associated with supported AWS resources for TLS termination. This differs from an ACM-issued public certificate: ACM never exposes the private key it generated, whereas an import explicitly supplies an owner-held key. Imported certificates do not receive ACM-issued-certificate automatic renewal; the owner must monitor expiration, renew or reissue with the original CA, and re-import and replace the certificate before it expires.
Transcript
10:52 And finally you can also import your own certificate.
10:55 For example, you already got a certificate which is signed by some well-known uh CA then you can import
11:00 that certificate along with its private key, so that ACM can then associate that with the AWS resources
11:07 and can handle the TLS termination.
11:10 But otherwise, for the certificates which are issued by the ACM, it never gives you the private key
11:16 it keeps with itself.
11:17 Right.
11:18 So that's the difference.
11:19 So I hope that is clear.
11:21 And you now know what is ACM and where to use ACM certificates.
11:26 So with that we'll stop here for this lecture and see you in the next lecture.
11:31 Thank you.
整讲总结 / Overall Summary
中文
ACM 为 AWS Integrated Service 提供 Public TLS Certificate 的申请、Domain Validation、部署与 Managed Renewal；Public Certificate 的 Private Key 不可导出，区域资源在本 Region 使用，CloudFront 固定从 us-east-1 取 Viewer Certificate。内部 PKI、Client Certificate 与可自定义 CA Policy 属于 AWS Private CA。Wildcard、Renewal Validation 与 Imported Certificate 的手工续期责任是主要考试和运维要点。
English
ACM provides public TLS-certificate requests, domain validation, deployment, and managed renewal for integrated AWS services. Public-certificate private keys are not exportable; regional resources use certificates in their region, while CloudFront viewer certificates come from us-east-1. Internal PKI, client certificates, and custom CA policy belong to AWS Private CA. Wildcard scope, renewal validation, and manual renewal responsibility for imported certificates are the main exam and operational points.
返回顶部 ↑