Encryption in Transit (ACM)
TLS termination and end-to-end encryption with AWS Certificate Manager.
Data transmitted over a network is vulnerable to interception, tampering, and impersonation if it is not encrypted. Transport Layer Security (TLS) encrypts data while in transit, and AWS Certificate Manager (ACM) simplifies provisioning, deployment, renewal, and management of the SSL/TLS certificates used to establish secure HTTPS connections.
Objectives
- Encrypt all traffic between clients and AWS services.
- Protect sensitive information during transmission.
- Authenticate servers using trusted SSL/TLS certificates.
- Automatically renew certificates without downtime.
- Eliminate manual certificate management.
- Meet security and compliance requirements.
Architecture
Components
| Component | Responsibility |
|---|---|
| AWS Certificate Manager (ACM) | Provides and manages free public SSL/TLS certificates with auto-renewal. |
| Application Load Balancer (ALB) | Terminates HTTPS, presents the ACM certificate, and routes traffic. |
| Application Server | Processes requests; HTTP inside a private VPC or HTTPS end-to-end. |
| Backend Services | RDS, Aurora, internal and third-party APIs — use TLS where supported. |
TLS handshake flow
- Client request — the client opens an HTTPS connection to
https://application.example.com. - Server certificate — the ALB presents the ACM-issued certificate (public key, domain, CA, expiration).
- Certificate validation — the client verifies the certificate is trusted, matches the domain, is unexpired, and has a valid chain.
- Key exchange — client and server negotiate TLS version, cipher suite, and session keys.
- Encrypted communication — all HTTP traffic is encrypted, integrity-verified, and authenticated.
If validation fails at step 3, the connection is rejected.
Authentication
- Client authentication of the server — validating a trusted CA, valid chain, correct domain, and expiration prevents man-in-the-middle (MITM) attacks.
- Server identity — the ACM certificate proves the server owns the corresponding private key and that the connection has not been intercepted.
Certificate lifecycle
Security best practices
- Redirect all HTTP traffic to HTTPS.
- Disable older TLS versions (TLS 1.0 and 1.1); use TLS 1.2 or 1.3.
- Enable end-to-end encryption for sensitive workloads.
- Rotate certificates automatically using ACM.
- Restrict backend resources using private subnets and security groups — see Private Networking.
- Enable logging and monitoring with AWS CloudTrail and ALB access logs.