Public SSL/TLS certificates provisioned through AWS Certificate Manager are free. You pay only for the AWS resources you create to run your application.
ACM Private Certificate Authority (CA) is priced along two dimensions. You pay a monthly fee for the operation of each private CA until you delete it and you pay for the private certificates you issue each month.
You pay a one-time fee for private certificates for which you have access to the private key. This fee is incurred in the AWS account from which you issue the certificate. For certificates you issue directly from a standalone Private CA, you are charged when you issue a certificate. For private certificates that you request through AWS Certificate Manager, you are charged only if you export the private key and certificate from ACM.
Private certificates issued from ACM Private CA for which you do not have access to the private key are free. These include certificates used exclusively with ACM-integrated services, such as Elastic Load Balancing, Amazon CloudFront, and Amazon API Gateway.
Certificate pricing tiers are based on the number of new certificates created in the calendar month and calculated per region (as indicated in the table at right).
30-day trial
Any new account to ACM Private CA can try the service for 30 days with no charge for operation of the first private CA created in the account and region. You pay for the certificates you issue during the trial period.
Example 1: One Region
Month 1 usage: Two Private CAs issue 20,000 certificates in US East (Northern Virginia) .
Month 2 usage: Two Private CAs issue no new certificates.
Charges for months 1 and 2
Month 1
2 x $400 (monthly CA operation)
+ 1,000 x $0.75 (first 1,000 certificates)
+ 9,000 x $0.35 (next 1,001 up to 10,000 certificates)
+ 10,000 x $0.001 (above 10,000 certificates)
= $4,710
Example 2: Two Regions
Month 1 usage: One Private CA in US East (N. Virginia) issues 500 certificates and one Private CA in US West (Oregon) issues 500 certificates.
Month 2 usage: One Private CA in US East (N. Virginia) and one Private CA in US West (Oregon) issue no new certificates.
Charges for months 1 and 2
Example 3: Combination of Free and Paid
Month 1 usage: One Private CA in US East (N. Virginia) issues a total of 5,000 new certificates in US East (Northern Virginia). Of the 5,000 issued, you use 1,000 exclusively with ACM-integrated services, such as Elastic Load Balancing or API Gateway. You are not charged for these certificates. Of the 4,000 remaining, you export 2,000 from ACM and you issue 2,000 from your Private CA by creating the private key yourself without using ACM for certificate management. You are charged for these because you have access to the private key.
Month 2 usage: One Private CA in US East (N. Virginia) issues no new certificates.
Charges for months 1 and 2
Month 1
1 x $400 (monthly CA operation)
+ $0 (no charge) for 1,000 certificates issued and used with ACM-integrated services
+ 1,000 x $0.75 (first 1,000 certificates)
+ 3,000 x $0.35 (next 1,001 up to 10,000 certificates)
= $2,200
Additional pricing resources
Easily calculate your monthly costs with AWS
Additional resources for switching to AWS
Get started building with AWS Certificate Manager in the AWS Management Console.