A public permits website terminates TLS on Application Load Balancers across multiple AWS accounts and needs centrally requestable certificates with automatic renewal. Which certificate approach best fits?
Select an answer to reveal the explanation.
Short Explanation
ACM is the city clerk for TLS: request, validate, auto-renew, attach to ALBs. Spreadsheet reminders and USB-passed PEMs are how public portals get expired-certificate outages. Keep HTTPS on and let ACM handle renewals.
Full Explanation
A public permits website that terminates TLS on Application Load Balancers across multiple accounts should use AWS Certificate Manager public certificates in each account and Region where ALBs terminate TLS. After domain validation, ACM automatically renews those certificates, removing calendar-driven outages that plague manually copied PFX files. Each ALB references an ACM certificate in the same Region, which matches how ACM integrates with Elastic Load Balancing for citizen-facing HTTPS.
Installing manually purchased certificates from shared network folders and renewing them with calendar reminders reintroduces forgotten-expiry risk and private-key handling mistakes across accounts. Disabling HTTPS on permits ALBs avoids certificates by abandoning transport security for residents. Storing private keys in public S3 buckets so every account can copy the same certificate freely exposes private keys and is never an acceptable multi-account certificate distribution method.
Exam caveat: ACM certificates are Regional for ALB/NLB associations (CloudFront uses us-east-1); automatic renewal applies to ACM-issued certificates validated through ACM—not to arbitrary third-party certs imported without ACM management. Operational check: request or validate ACM certificates in each ALB Region/account, attach them to HTTPS listeners, confirm DNS validation succeeds, and verify renewal eligibility status well before expiry.