All Posts
2026-08-19devopsn

Automate SSL on EC2 with AWS Certificate Manager ACME Support

AWSEC2SSLACMESecurity
A

Automate SSL on EC2 with AWS Certificate Manager ACME Support

For years, securing applications running on an AWS EC2 instance meant setting up Let's Encrypt alongside Certbot. While this approach worked perfectly, it still required relying on an external Certificate Authority and managing configurations manually on the server itself.

Recently, AWS introduced ACME support for AWS Certificate Manager (ACM). This change allows you to seamlessly provision and renew SSL certificates for workloads that terminate TLS directly, giving you the best of both worlds: Certbot's automation and ACM's enterprise-grade governance.

In this guide, we will walk through the process of deploying an SSL certificate for an Nginx server running on EC2 using AWS ACM's new ACME capability. If you are already familiar with standard ACME clients like Certbot, adapting to this workflow is incredibly simple, as the only major change is pointing the ACME client to AWS instead of Let's Encrypt.

Architecture Overview

We are going to secure an Nginx application running on an EC2 instance using an SSL certificate issued via AWS Certificate Manager.

The architecture for this process operates as follows:

  1. An Ubuntu EC2 instance runs the Nginx web server.
  2. Certbot (acting as the ACME client) is installed on the instance.
  3. Instead of communicating with a public CA, Certbot communicates with the AWS Certificate Manager ACME Endpoint.
  4. Certificates are issued by the Amazon Trust Services CA and securely stored on the instance for Nginx to use.

Unlike traditional ACM integrations—which typically rely on an Application Load Balancer or AWS CloudFront—the certificate in this setup is installed directly onto the EC2 instance since Nginx handles the HTTPS termination.

Prerequisites

Before diving into the setup, ensure you have the following resources ready:

  • An active AWS account
  • A running Ubuntu EC2 instance
  • A registered domain name
  • A DNS record routing traffic from your domain to the EC2 instance's public IP
  • SSH access to the server
  • Appropriate AWS IAM permissions to configure AWS Certificate Manager

For this demonstration, we will assume:

  • Domain: app.example.com
  • Operating System: Ubuntu 24.04
  • Web Server: Nginx

Step 1: Install Nginx on EC2

First, connect to your EC2 instance via SSH. Update your package manager and install Nginx.

sudo apt update
sudo apt install nginx -y

Once installed, verify that the Nginx service is actively running:

sudo systemctl status nginx

If you navigate to http://app.example.com in your web browser and see the default Nginx welcome page, you are ready to proceed to the next step.

Step 2: Create an ACM ACME Endpoint

Next, you need to configure AWS to accept ACME requests.

  1. Open the AWS Management Console.
  2. Navigate to AWS Certificate Manager.
  3. Look for the new ACME Endpoints configuration section.
  4. Click Create ACME Endpoint.

Provide a distinct endpoint name, specify the allowed domain names, and choose your preferred validation method.

Once AWS provisions the endpoint, carefully note down the following credentials:

  • ACME Directory URL
  • External Account Binding (EAB) Key ID
  • EAB Secret

You will need these values to configure Certbot on your EC2 instance.

Step 3: Install Certbot

Return to your EC2 instance terminal and install Certbot using Snap.

sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot

Verify the installation succeeded by checking the Certbot version:

certbot --version

Step 4: Configure Certbot for AWS ACM

By default, Certbot attempts to communicate with Let's Encrypt. We need to redirect it to our newly created ACM ACME endpoint using the credentials generated in Step 2.

Run the following command, replacing the placeholders with your actual AWS details:

certbot certonly \
  --server <AWS_ACME_DIRECTORY_URL> \
  --eab-kid <EAB_KEY_ID> \
  --eab-hmac-key <EAB_SECRET> \
  -d app.example.com

When executed, Certbot will bypass Let's Encrypt and negotiate directly with AWS Certificate Manager.

Step 5: Domain Validation

Depending on the configuration of your ACME endpoint, Certbot will require you to validate domain ownership.

  • HTTP Challenge: Ensure that port 80 on your EC2 instance is open to the internet so the ACME server can verify the challenge file.
  • DNS Challenge: Add the specified TXT record to your DNS provider.

Upon successful validation, AWS issues the SSL certificate. You can verify its existence within the AWS Console under Certificate Manager.

Step 6: Configure Nginx for HTTPS

Now that the certificate is securely stored on your instance, you must configure Nginx to use it.

Open your Nginx virtual host file and update it to handle SSL traffic:

server {
    listen 443 ssl;
    server_name app.example.com;
    ssl_certificate /etc/letsencrypt/live/app.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
    
    location / {
        proxy_pass http://localhost:8080;
    }
}

Even though AWS generated the certificate, Certbot stores the files locally in its standard directory structure, allowing Nginx to read them natively.

Restart the Nginx service to apply the configuration changes:

sudo systemctl restart nginx

Step 7: Verify the Secure Connection

Open your web browser and navigate to https://app.example.com.

You should now observe a secure, encrypted connection with a valid SSL certificate and no browser warnings. For further verification via the command line, you can test the certificate details:

openssl s_client -connect app.example.com:443

Step 8: Test Automatic Certificate Renewal

One of the primary benefits of the ACME protocol is hands-off certificate renewal. To ensure your configuration is ready for automatic renewals, execute a dry run:

sudo certbot renew --dry-run

If successful, Certbot will seamlessly handle future renewals before the certificate expires, significantly reducing operational overhead.

Why Choose ACM ACME over Let's Encrypt?

While Let's Encrypt remains a fantastic service, migrating to AWS ACM's ACME support offers substantial benefits for enterprise teams deeply invested in the AWS ecosystem.

Key advantages include:

  • Centralized Visibility: View all certificates across your infrastructure from a single AWS dashboard.
  • Access Control: Leverage AWS IAM to enforce strict governance policies.
  • Auditing: Monitor certificate operations through CloudTrail logs.
  • Metrics: Track usage and performance using CloudWatch.

This setup is ideal for architectures where workloads manage their own TLS termination, such as EC2 instances running Apache or Nginx, self-managed Kubernetes nodes, Docker containers, and hybrid on-premises environments.

Conclusion

The addition of ACME support to AWS Certificate Manager effectively bridges the gap between the simplicity of Certbot and the robust governance of AWS.

By simply creating an ACME endpoint and adjusting a few flags in your Certbot command, you can dramatically improve the manageability, visibility, and security of your EC2-hosted SSL certificates without sacrificing the automated workflows your team already relies upon.