docs/documentation/platform/pki/ca/aws-acm-public-ca.mdx
Infisical integrates with AWS Certificate Manager (ACM) to issue public certificates signed by Amazon Trust Services. These certificates are trusted by all major browsers and operating systems out of the box, so they can be used on the public internet without users having to install anything.
Common use cases include securing public-facing websites and APIs, terminating TLS on internet-facing load balancers, and issuing certificates for SaaS applications exposed to external users.
Each certificate has a fixed 198-day validity and is generated and stored by AWS. Infisical orchestrates the full lifecycle on top: domain validation via Route 53, saving the certificate and private key into Infisical, scheduled auto-renewal, and revocation.
<Note> Domain validation is performed exclusively through **Amazon Route 53**. Other DNS providers are not supported for this CA type. </Note>ACM connection — needs the following on certificates in your account:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"acm:RequestCertificate",
"acm:DescribeCertificate",
"acm:ExportCertificate",
"acm:RenewCertificate",
"acm:RevokeCertificate",
"acm:ListCertificates"
],
"Resource": "*"
}
]
}
Route 53 connection — needs the following on your hosted zone so Infisical can write the ACM validation CNAME records:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"route53:GetHostedZone",
"route53:ChangeResourceRecordSets"
],
"Resource": "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID"
}
]
}
ACM certificates expire after 198 days. There are two renewal paths that both end up producing a fresh certificate in Infisical.
AWS attempts to automatically renew ACM public certificates 45 days before expiry. This is ACM managed renewal and happens on AWS's schedule, independent of Infisical. When it succeeds, AWS issues a new certificate body and private key under the same ARN but with a new serial number.
The catch: AWS only updates the copy held inside ACM. The copy saved in Infisical still holds the old material until something pulls the new version out.
To keep the copy stored in Infisical in sync with AWS, enable auto-renewal on the certificate profile when you create or edit it:
Every certificate issued through that profile inherits these values. You can also override them on an individual certificate from Certificates → Manage Renewal.
When a certificate reaches the configured threshold, Infisical reconciles it with AWS:
In both cases the renewed certificate is stored as a new entry linked to the original and inherits the same auto-renewal settings — so the cycle continues automatically.
<Note> AWS generates a fresh private key on every renewal. Infisical pulls it in each time and stores it encrypted with your project's KMS key. </Note>Failed to reach AWS Certificate Manager — the ACM connection credentials are invalid or missing the IAM permissions above.
Failed to access Route 53 hosted zone — the Route 53 connection cannot read the hosted zone, or the Hosted Zone ID is wrong. Check route53:GetHostedZone and that the zone is public.
Request stays pending — DNS validation can take several minutes. Infisical retries automatically. Verify the CNAME records exist in Route 53 and that the hosted zone is authoritative for the requested domain.
Renewal appears stuck — immediately after renewal is triggered, ACM may not yet have the new certificate available. Infisical treats this as transient and retries until a new serial number appears on the ARN.