Executive summary
ACM now supports “AWS PrivateLink for ACME public certificate issuance, allowing you to request and renew public TLS certificates over a private network path that stays within the AWS network.” All commercial Regions. Standard PrivateLink charges.
Worth being precise about the scope immediately, because this week has had two Private CA posts next to it: this is the public certificate path, not #71's private CA. Same protocol family, different trust store, different bill.
The mechanism is the interesting part. You create a managed ACME endpoint, then a standard interface endpoint, and then nothing else happens — because “Private DNS resolves your existing ACME directory URL to the interface endpoint inside your VPC automatically.”
What changed
Before: an ACMEv2 client in a private subnet reached ACM's public ACME directory, which needed a NAT gateway or an internet gateway. After: the same client reaches an ENI in your VPC.
Five operations are named as moving onto the private path: “Issuance operations—account creation, order creation, domain validation, finalization, and certificate retrieval—then flow over PrivateLink.”
And the client side is explicitly untouched: “If you're already using ACME with ACM, setup requires no changes to your ACME clients… the same client configuration and directory URL continue to work with no reconfiguration.” Any ACMEv2-compatible client works, so this reaches cert-manager, certbot and anything else speaking the protocol without a plugin.
Architecture
The transparency is the design, and the thing to plan around
Private DNS resolution means the directory URL is unchanged, the client config is unchanged, and the path
is different. That is excellent for adoption — nobody edits a cert-manager
ClusterIssuer — and it has one consequence worth naming.
Which path a certificate took is not recorded anywhere on the client. It is a property of the VPC that resolved the name. The same manifest deployed into a VPC with the endpoint and a VPC without it produces certificates that are identical and journeys that are not.
The service side does keep a record — “All activity remains visible in the ACM console with AWS CloudTrail logging and Amazon CloudWatch metrics for auditability” — so the information exists. It is just not where somebody debugging a cluster would look, and "did this renewal leave the VPC?" is answered by VPC configuration rather than by the client.
Domain validation is listed among the operations that flow over PrivateLink, and for a client that means its exchange with ACM about the challenge moves onto the private path. How the certificate authority performs the actual challenge check for a publicly trusted certificate is a separate question, and the announcement does not speak to it. If your validation method matters to a network design — an HTTP-01 challenge has to be reachable from somewhere — that is worth establishing in a test account rather than inferring from this sentence.
Business value
The concrete win is removing a reason for egress. A private subnet that needed a NAT gateway only so that certbot could reach a public directory URL now does not, and the general case — "this workload has no business talking to the internet, except for this one thing" — is the shape that produces permanent exceptions in a network design.
The second win is the one that does not show up on a diagram: it is adoptable without touching workloads. Zero client changes means the migration is a VPC change, which is a different team, a different change window and a different risk profile from editing issuance config across a fleet.
Security considerations
The traffic staying inside the AWS network is the stated benefit, and the practical effect is that certificate issuance stops being a reason to keep an egress path open. Where that was the last such reason, the NAT gateway can go, which removes an exfiltration path rather than just a line item.
An interface endpoint is a resource with a policy, which is a gain over an egress route that has none. Standard VPC endpoint controls apply, so issuance becomes something you can constrain at the network layer rather than only at the IAM layer.
And the auditability claim is about the service, not the client. CloudTrail and CloudWatch carry the record. If an investigation needs to establish that a given certificate was issued over the private path, that evidence is on the AWS side, and it is worth confirming you can actually produce it before you need it.
Cost considerations
“Standard AWS PrivateLink charges apply for interface endpoints”, and the pricing page is clear about the billing unit: “You will be billed for each hour that your VPC endpoint remains provisioned in each Availability Zone.” A worked example on that page states “you will be charged $0.01 per hour for each endpoint ENI”, and data processing is tiered from “First 1 PB $0.01” per GB.
At that rate an endpoint across three Availability Zones is about $22 a month before data processing — and certificate issuance is not a high-volume data flow, so the hourly charge is essentially the whole bill.
Worth putting next to what it replaces rather than next to zero. A NAT gateway is “charged on an hourly basis” and AWS's example rate is “$0.045 per hour”, with the same per-AZ multiplication — “hourly charges will amount to $0.045 x 3 = $0.135 per hour… provisioned across three AZs”. Against three endpoint ENIs at $0.03 an hour, that is roughly four and a half times the hourly charge, and the data processing rates differ the same way: $0.045 per GB for the NAT gateway against $0.01 for PrivateLink.
So if the endpoint lets you remove a NAT gateway that existed for this traffic, the swap is clearly cost-negative — on the order of seventy-five dollars a month saved across three AZs, before any data. If the NAT gateway stays for other reasons, this is about twenty-two dollars a month for a network property rather than a capability.
One caveat on that figure: the per-ENI rate appears in a worked example on the pricing page rather than in a headline rate table, so it is worth checking against your Region before putting it in a plan.
Operational considerations
The setup is two resources, in order. “After you create your managed ACME endpoint in ACM, you create a standard VPC interface endpoint using the VPC console, AWS CLI, or AWS CloudFormation.” The ACM-side endpoint comes first; the VPC-side one is ordinary.
Private DNS must be on for the redirect to happen. The behaviour described depends on private DNS resolving the existing directory URL inside the VPC, which is a setting on the interface endpoint. An endpoint created without it leaves clients resolving the public name and taking the old path — successfully, and silently.
Rollback is a DNS property too. Because nothing in the client points at the endpoint, removing or disabling the endpoint returns issuance to the public path without a client change — provided the egress route still exists. If you removed the NAT gateway, it does not, and the failure appears at renewal rather than at the change.
Test renewal, not issuance. First issuance is what gets verified during a migration; renewal is what happens sixty days later, often from a different code path, and it is the one that discovers a missing egress route.
Tradeoffs
| Choice | You get | You accept |
|---|---|---|
| Public path (today's default) | No endpoint, no endpoint cost | An egress route maintained partly for certificate issuance |
| PrivateLink endpoint, keep NAT | Issuance traffic off the internet; an endpoint policy to constrain it | About $22 a month across three AZs, for a network property |
| PrivateLink endpoint, remove NAT | The same, and likely cost-negative | Renewal now depends on the endpoint; rollback is no longer free |
| Endpoint without private DNS | Nothing, in practice | Clients keep taking the public path, and it still works, so nothing reports the mistake |
Implementation guidance
Enable private DNS on the interface endpoint, and verify resolution from inside the VPC rather than inferring it from the endpoint existing. Resolving the directory hostname from a workload subnet and checking it returns a VPC address is the one test that distinguishes a working setup from a setup that looks identical and is not.
Decide about the NAT gateway deliberately and separately. Removing it is where the money is and where the rollback path goes.
Attach an endpoint policy when you create it, while the endpoint is new and nothing depends on it.
Then force a renewal in a test account and confirm it completes over the endpoint, because renewal is the operation that runs unattended.
Best practices
Record which VPCs have the endpoint, because the clients will not. With identical client configuration on both paths, your endpoint inventory is what answers "which workloads issue privately?" from your own side. The service-side record exists in CloudTrail, but reconstructing a fleet-wide answer from it is an investigation rather than a lookup.
Treat the endpoint as part of the certificate's availability chain. Once the NAT gateway is gone, an endpoint problem is a renewal outage with a sixty-day fuse.
Alarm on renewal failures rather than on endpoint health. The thing you care about is a certificate that did not renew; endpoint health is a cause, not the symptom.
Keep the scope distinction visible in your own docs. This is ACM public certificates. Private CA issuance is a different service with a different trust store, and the two now have similarly shaped network stories.
Who should adopt this
Anyone running ACMEv2 clients in private subnets gets the clearest benefit, because the change is a VPC addition with no workload edit.
Anyone whose NAT gateway exists substantially for this traffic should price the swap. It is the case where the endpoint pays for itself.
Anyone with a no-egress requirement who had carved an exception for certificate issuance can now close it, which is worth doing while the exception is still documented as an exception.
Key takeaways
A managed ACME endpoint plus an interface endpoint, and private DNS does the rest. No client changes, all commercial Regions, about $22 a month across three AZs.
The thing to carry away is that the path is invisible from the client by design. That makes adoption easy and makes "which workloads issue privately?" a question about VPC inventory rather than about configuration — so the answer has to be maintained somewhere other than the thing doing the issuing.
Which rhymes with today's #75, where a score is computed from a population you cannot see from the number. Here the number is fine and it is the route that is unobservable from one end. In both cases the fact exists in AWS's records and not in the place the reader is standing.
Official AWS references
- AWS Certificate Manager now supports ACME issuance through AWS PrivateLink — the setup steps, the operations that move onto the private path, Region availability and the private DNS behaviour
- Amazon VPC pricing — the NAT gateway hourly and data processing rates this endpoint is weighed against
- AWS PrivateLink pricing — per-AZ hourly billing for interface endpoints and the data processing tiers
Comments