AWS brings ACME certificate automation to GovCloud

AWS Certificate Manager (ACM) now supports ACME in AWS GovCloud (US-East) and AWS GovCloud (US-West). In its October 29, 2026, announcement, AWS says the service provides a fully managed ACME server endpoint that issues public TLS certificates from Amazon Trust Services.

Availability and client compatibility

AWS says the endpoint works with any ACMEv2-compatible client, naming Certbot, cert-manager for Kubernetes, and acme.sh as examples. The announced availability covers public TLS certificates in both GovCloud regions.

For engineering teams, the important distinction is between the client interface and the issuing service. ACME provides the standards-based interface for certificate automation, while ACM supplies the managed endpoint. Teams already using ACME clients have a familiar starting point, but should not treat protocol compatibility as a promise that an existing configuration will work unchanged.

Renewal automation needs a deployment plan

AWS presents the rollout as a way to automate certificate issuance and renewal through existing ACME tooling. Its announcement also directs readers to ACM documentation and pricing information. Source: AWS.

For adoption, evaluate issuance and deployment as separate steps. Before a production rollout:

• Consult the ACM documentation for client setup and certificate-validation requirements.
• Review the pricing applicable to the intended deployment.
• Exercise renewal and verify that the intended TLS endpoints actually serve the replacement certificate.
• Check that failures trigger alerts early enough to act before expiration.

The useful acceptance test is not just whether an ACME client can obtain a certificate. It is whether the complete renewal-to-deployment workflow leaves the application serving the right certificate. A managed issuing endpoint should be evaluated as one part of that workflow, not as a substitute for deployment checks.