AWS Certificate Manager Pricing
Public SSL/TLS certificates provisioned through AWS Certificate Manager are free. You pay only for the AWS resources you create to run your application.
AWS Certificate Manager Private Certificate Authority Pricing
ACM Private Certificate Authority (CA) is priced along two dimensions. You pay a monthly fee for the operation of each private CA until you delete it and you pay for the private certificates you issue each month.
Private Certificate Authority Operation
Private Certificates
You pay a one-time fee for private certificates for which you have access to the private key. This fee is incurred in the AWS account from which you issue the certificate. For certificates you issue directly from a standalone Private CA, you are charged when you issue a certificate. For private certificates that you request through AWS Certificate Manager, you are charged only if you export the private key and certificate from ACM.
Private certificates issued from ACM Private CA for which you do not have access to the private key are free. These include certificates used exclusively with ACM-integrated services, such as Elastic Load Balancing, Amazon CloudFront, and Amazon API Gateway.
Certificate pricing tiers are based on the number of new certificates created in the calendar month and calculated per region (as indicated in the table below).
ACM Private CA 30-day Free Trial
Any new account to ACM Private CA can try the service for 30 days with no charge for operation of the first private CA created in the account and region. You pay for the certificates you issue during the trial period. Start a free trial of ACM Private CA »
Online Certificate Status Protocol (OCSP)
- $0.06 per certificate per month if Private CA generated an OCSP response for that certificate. If there were no queries for a certificate during a month, there is no charge.
- $0.20 per 100,000 OCSP queries, billed on a per-CA basis.
Pricing examples
Example 1: One Region
Month 1 usage: Two Private CAs issue 20,000 certificates in US East (Northern Virginia) .
Month 2 usage: Two Private CAs issue no new certificates.
Charges for months 1 and 2
Month 1
2 x $400 (monthly CA operation)
+ 1,000 x $0.75 (first 1,000 certificates)
+ 9,000 x $0.35 (next 1,001 up to 10,000 certificates)
+ 10,000 x $0.001 (above 10,000 certificates)
= $4,710
Example 2: Two Regions
Month 1 usage: One Private CA in US East (N. Virginia) issues 500 certificates and one Private CA in US West (Oregon) issues 500 certificates.
Month 2 usage: One Private CA in US East (N. Virginia) and one Private CA in US West (Oregon) issue no new certificates.
Charges for months 1 and 2
Example 3: Combination of Free and Paid
Month 1 usage: One Private CA in US East (N. Virginia) issues a total of 5,000 new certificates in US East (Northern Virginia). Of the 5,000 issued, you use 1,000 exclusively with ACM-integrated services, such as Elastic Load Balancing or API Gateway. You are not charged for these certificates. Of the 4,000 remaining, you export 2,000 from ACM and you issue 2,000 from your Private CA by creating the private key yourself without using ACM for certificate management. You are charged for these because you have access to the private key.
Month 2 usage: One Private CA in US East (N. Virginia) issues no new certificates.
Charges for months 1 and 2
Month 1
1 x $400 (monthly CA operation)
+ $0 (no charge) for 1,000 certificates issued and used with ACM-integrated services
+ 1,000 x $0.75 (first 1,000 certificates)
+ 3,000 x $0.35 (next 1,001 up to 10,000 certificates)
= $2,200
Example 4: The customer has 2 CAs. The first CA is a root CA and the second CA is an issuing subordinate.
In January, the subordinate CA issues 5 certificates for TLS. That month the five certificates receive the following OCSP queries 1: 10 queries per hour; 2: 1 query per hour; 3: 100 queries per hour; 4: 1 query per day; 5: 50 queries per hour. All of these solutions check the certificate status of the issuing CA as well.
| Price list item | Number of items | Price per item | Total cost |
| OCSP responses created | 6 |
$0.06 | $0.36 |
| OCSP queries responded to | 231,840 | $0.20/100k | $0.46 |
| Total Monthly Charge | $0.76 |
Example 5: The customer has 2 CAs. The first CA is a root CA and the second CA is an issuing subordinate.
In January, the subordinate CA issues 10k certificates for TLS. That month each of the certificates receives one OCSP query per hour. All of these checks validate the certificate status of the issuing CA as well.
| Price list item | Number of items | Price per item | Total cost |
| OCSP responses created | 10,001 | $0.06 | $500.06 |
| OCSP queries responded to | 7,200,000 | $0.20/100k | $14.40 |
| Total Monthly Charge | $514.46 |
Additional pricing resources
Easily calculate your monthly costs with AWS
Additional resources for switching to AWS
Get started building with AWS Certificate Manager in the AWS Management Console.