Dora NodaOn July 6, 2026, AWS Certificate Manager started speaking ACME — the same open protocol Let's Encrypt built to make TLS automation free for the entire internet. On paper it looks like a peace offering: point cert-manager, Certbot, or acme.sh at a new managed endpoint and get certificates from Amazon Trust Services instead. What the announcement doesn't put in the headline is the price tag. AWS charges $1.00 per domain, every time a certificate issues or renews — and at the new 45-day validity window it's shipping, that meter spins fast.
Run the math on a self-hosted platform provisioning TLS for 500 tenant custom domains and the gap isn't subtle: roughly $4,000 a year on AWS's new ACME endpoint, versus $0 on the free Let's Encrypt service cert-manager already talks to. Here's exactly where that number comes from, what AWS is actually selling instead of savings, and what the CA/Browser Forum's shrinking certificate lifetimes mean for whichever CA you pick.
What AWS Actually Shipped
The feature itself is straightforward and, taken on its own, useful: AWS Certificate Manager now runs a fully managed ACME server endpoint that issues public TLS certificates to any ACMEv2-compatible client. That's the same protocol family Let's Encrypt, ZeroSSL, and Google Trust Services already speak — so cert-manager, Certbot, and acme.sh work against it with no new client code, just a different ACME directory URL and account registration.
Certificates issued through the endpoint carry a 45-day validity period, deliberately undercutting the CA/Browser Forum's phased mandate (more on that below) rather than waiting for it to force the issue. AWS pairs the shorter lifetime with governance controls aimed squarely at large organizations: PKI administrators can define domain scopes restricting which certificates a given ACME client is allowed to request, enforce policy on wildcard issuance, and delegate certificate requests to individual application teams without ever handing those teams a shared DNS credential.
That last point is the real product. It's a centralized control plane for who's allowed to request what — not a cheaper way to get a certificate.
The Pricing Nobody Put in the Headline
AWS Certificate Manager has always been free for certificates you deploy to AWS-managed resources — an Application Load Balancer, CloudFront, API Gateway. The new ACME endpoint is a different product: it issues exportable, portable certificates for anything that isn't a native AWS resource, which is exactly the use case for cert-manager running on a Kubernetes cluster, whether that cluster lives in EKS or, as with a Cluster-API-managed fleet, nowhere near AWS at all. That product is metered, per AWS's own pricing page:
| Volume tier (FQDN occurrences per account, per month) | Price |
|---|---|
| First 1,000 | $1.00 each |
| Next 3,000 (1,001–4,000) | $0.50 each |
| Beyond 4,000 | $0.25 each |
| First 500 wildcards | $5.00 each |
| Beyond 500 wildcards | $2.50 each |
| First 30,000 ACME API calls/month | Included |
| Each additional 10,000 API calls | $0.50 |
Two details matter more than the sticker price. First, the meter counts every issuance and every renewal as a billable occurrence — a certificate isn't a one-time purchase, it's a recurring line item that fires on whatever cadence you renew it. Second, AWS's own worked example in the announcement makes the mechanics explicit: 50 domains renewing monthly costs 50 × $1.00 = $50/month, or $600/year. That's the baseline this whole comparison scales from — and it assumes a comparatively gentle 30-day renewal cadence. AWS's own default is a tighter 45 days.
The Worked Comparison
Here's the number that actually matters for a platform provisioning TLS on behalf of tenants: what does a fleet of custom-domain certificates cost per year at AWS's 45-day cadence, against the same fleet renewed for free through Let's Encrypt?
At 45 days, a certificate renews 365 ÷ 45 ≈ 8.1 times per year — nearly double the roughly 4.1 renewals a 90-day Let's Encrypt certificate needs today. Multiplying that renewal frequency by AWS's per-domain fee gives a clean annual cost per certificate, before any volume discount kicks in:
| Tenant custom domains | Cadence | AWS ACM ACME — per-domain FQDN certs | AWS ACM ACME — per-tenant wildcards | Free Let's Encrypt via cert-manager |
|---|---|---|---|---|
| 50 | 45 days | ~$405/yr | ~$2,030/yr | $0 |
| 500 | 45 days | ~$4,055/yr | ~$20,275/yr | $0 |
| 5,000 | 45 days | ~$26,000/yr* | n/a | $0 |
*At 5,000 domains, monthly FQDN-occurrence volume (roughly 3,300/month at a 45-day cadence) crosses into AWS's cheaper per-domain tiers, so the blended rate drops below $1.00/domain — but the total still climbs into five figures, not toward zero. These figures cover domain fees only; ACME API call charges are additional but marginal at this scale, since a typical issuance uses only a handful of API calls, well inside the 30,000/month free allowance until a fleet reaches the low thousands of certificates.
The wildcard column shows why "just use one certificate per tenant apex domain" doesn't rescue the economics on AWS's endpoint, either — a wildcard costs 5x what a single FQDN does per issuance, and the same 45-day renewal clock applies to it. The free column doesn't move regardless of scale, because Let's Encrypt has never charged per certificate, per domain, or per renewal — the entire pricing model AWS just introduced simply doesn't exist on the CA that cert-manager has defaulted to since the project began.
Why AWS Built This Anyway
None of this means AWS shipped a bad product — it means AWS shipped a product for a buyer who isn't optimizing for the lowest TLS bill. The domain-scoping and delegation controls solve a real problem for a large enterprise: dozens of internal teams each requesting certificates for their own subdomains, today coordinated through shared DNS credentials or a ticket queue to a central security team. A managed ACME endpoint where a platform team can grant team-a.example.com/* to one ACME account and team-b.example.com/* to another, with every issuance logged to CloudTrail, is worth real money to an organization that size — the same way AWS's other governance-first products (Organizations, Control Tower, IAM Identity Center) sell centralized control as the feature, not a lower bill.
For a self-hosted platform's own tenant-facing TLS pipeline, that governance need is already met differently: cert-manager's Issuer/ClusterIssuer resources scope which namespaces can request certificates against which ACME account, and Let's Encrypt's rate limits (50 certificates per registered domain per week) are generous enough for anything short of enterprise-internal certificate sprawl. AWS's ACME endpoint is a genuinely useful option for a team already standardized on AWS governance tooling. It is not a reason to move a self-hosted platform's tenant-domain certificates off the CA that's been free the entire time.
What the 47-Day Mandate Actually Changes
AWS's 45-day default isn't arbitrary — it's undercutting a schedule the CA/Browser Forum locked in back in April 2025. Ballot SC-081v3 phases the maximum validity of every publicly trusted TLS certificate down from 398 days to 200 (March 2026), then 100 (March 2027), then a hard 47 days by March 2029 — a floor every public CA, including Let's Encrypt, has to obey. (The full timeline, and what it does to renewal-automation slack, is worth a closer read on its own — we covered it in detail here.)
The mandate's real effect on this specific comparison is asymmetric. For a platform on free Let's Encrypt, shrinking lifetimes mean more automation cycles, not more dollars — cert-manager renews more often, DNS-01 challenges run more frequently, but the certificate itself still costs nothing. For a platform on AWS's metered ACME endpoint, shrinking lifetimes mean the same per-domain fee, charged nearly twice as often — the 90-day-to-47-day transition alone roughly doubles the annual bill in the tables above, since renewal frequency is the direct multiplier on a per-issuance charge. A pricing model built around "you pay every time you renew" gets structurally worse for the buyer exactly as the industry-wide mandate forces everyone to renew more.
What a Self-Hosted PaaS's Own Pipeline Should Do About It
None of this changes the engineering work a shrinking-lifetime world demands — it just confirms which CA should be doing it for free. The concrete steps are the same regardless of which ACME endpoint sits behind them:
- Split platform subdomains from tenant custom domains. A single wildcard certificate for
*.yourplatform.com, issued via DNS-01 against DNS records you already control, covers every app on your own subdomain with one ACME transaction — cheap to renew at any frequency because there's no per-tenant coordination involved. - Tighten
renewBeforedeliberately.cert-manager'sCertificateresource defaults were tuned for a 90-day world. At 45 days, a renewal buffer that leaves less than a week of retry room for a failed DNS propagation or a rate limit is cutting it close. - Budget controller capacity for renewal volume, not just correctness. Doubling renewal frequency across a multi-tenant fleet roughly doubles
CertificateRequestchurn —cert-manager's own best-practice docs flag this as a reason to scale webhook replicas and controller memory headroom before volume, not after an outage shows the undersizing.
Every one of those is infrastructure work a self-hosted platform does once, on top of a CA that costs nothing to call as many times as the mandate ends up requiring. AWS just made the alternative to that free, cert-manager-native path explicit — and priced it.
Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own, with per-app and per-custom-domain TLS provisioned and renewed automatically on cert-manager and Let's Encrypt underneath, with no per-domain meter running behind the scenes. Star the repo on GitHub or deploy your first app today.
