Guides

The End of Manual TLS Certificate Management: A Deadline for 2026

Manual certificate management for TLS is becoming obsolete-AWS Certificate Manager has supported ACME since July 2026, and Kubernetes teams should start…

By Alec Chizhik July 18, 2026 4 min read

The End of Manual TLS Certificate Management: A Deadline for 2026

A lapsed TLS certificate can take down a website just as effectively as a server outage – only more embarrassingly, since it was entirely preventable. Since July 2026, the AWS Certificate Manager has supported the ACME protocol for public certificates, closing a gap that Let’s Encrypt has occupied for years. Manual certificate management is finally becoming obsolete.

Key Takeaways

ACME on AWS. Since July 2026, the AWS Certificate Manager has issued and automatically renewed public certificates via ACME.
45-day validity. The new certificates are valid for 45 days – a standard now enforced by the CA/Browser Forum’s push for shorter lifespans.
Kubernetes runs on autopilot. The renewal workflow integrates seamlessly with cert-manager, eliminating manual intervention.
Mid-market consolidation. Organizations heavily invested in AWS can now manage both public and internal certificates through a single process.

What’s possible right now

The Certificate Manager now provides a fully managed ACME endpoint that issues public TLS certificates from Amazon Trust Services. Requesting and renewing certificates happens automatically via any ACMEv2-compatible client – covering standard tools like Certbot for traditional servers, cert-manager for Kubernetes, and acme.sh for lightweight setups. The feature is available across all commercial AWS Regions.

The real game-changer is the workflow. Previously, ACM certificates were tightly coupled to AWS services like Load Balancers. With ACME, these certificates can now be deployed on any workload – even outside the AWS ecosystem – with the same hands-off automation admins expect from Let’s Encrypt.

Why shorter lifespans change everything

Certificates issued via ACME are valid for just 45 days – far shorter than previous norms. This reflects a deliberate industry shift: the CA/Browser Forum has mandated that public certificate validity will drop to a maximum of 47 days by 2029, down from 398 days. The first phase of this reduction took effect in March 2026.

The impact is both simple and unavoidable. A certificate that expires every few weeks can’t be managed manually. Teams still relying on calendar reminders for renewals in 2026 will eventually face outages when a critical site fails due to an expired certificate. Automation isn’t just an option anymore – it’s a necessity.

The workflow for Kubernetes teams

Kubernetes users already rely on cert-manager for certificate lifecycle management. With ACM’s ACME endpoint, Amazon Trust Services can now serve as the issuer – without disrupting existing workflows. A simple Issuer configuration lets cert-manager request, auto-renew, and store certificates as Secrets. Teams remain blissfully unaware of the 45-day cycle, as renewal happens silently in the background.

The practical benefit is consolidation. Previously, teams might use Let’s Encrypt for public certificates and ACM for internal AWS services. Now, both can be managed through a single, unified process – reducing tool sprawl, potential errors, and knowledge silos.

What your mid-market team should set up

Start with an audit: which public certificates are in use, where are they deployed, and who handles renewals today? Often, the answer lives in someone’s head rather than a documented system. That dependency becomes a critical risk as lifespans shrink.

Next, transition to an automated issuer. For Kubernetes, pair cert-manager with the ACM ACME endpoint; for traditional servers, use Certbot or acme.sh. Crucially, implement monitoring and alerts to catch any renewal failures. Automation without oversight just moves the problem – it doesn’t solve it.

A Standard Takes Hold

That AWS, the last major provider, is now adopting ACME is less an admission of playing catch-up than a clear signal. ACME has become the established, cross-vendor protocol everyone understands. If you’re automating certificates today, you should bet on this standard rather than proprietary paths that may need retooling tomorrow.

Shorter lifespans make the issue mandatory for anyone running a website or API. The good news: the tools are mature, free, and can be set up in an afternoon. There’s no longer any good reason to manage certificates by hand.

Frequently Asked Questions

What is the ACME protocol?

ACME stands for Automatic Certificate Management Environment and is a standardized protocol for automatically requesting, validating, and renewing TLS certificates. It became widely known through Let’s Encrypt. Since July 2026, AWS Certificate Manager has also supported ACME for public certificates.

How long are ACME certificates issued by ACM valid?

Certificates issued via the ACME endpoint are valid for 45 days – shorter than previous ACM certificates and in line with the industry mandate to cap public certificate lifespans at 47 days by 2029.

Which clients work with the ACM ACME endpoint?

Any ACMEv2-compatible client. In practice, that means Certbot for traditional servers, cert-manager for Kubernetes, and acme.sh for lightweight environments. The feature is available in all commercial AWS Regions.

Why are certificate lifespans being shortened in the first place?

Shorter lifespans limit the damage if a private key is compromised and enforce clean automation. The CA/Browser Forum has progressively lowered the maximum validity from 398 days to 47 days by 2029, with the first phase taking effect in March 2026.

Do I have to migrate from Let’s Encrypt to ACM?

No – it’s an optional move. The benefit lies in consolidation if you’re already heavily invested in AWS and want to manage both public and internal certificates through a single channel. Both services use the same ACME protocol, so the switch is technically straightforward.