AWS Certificate Manager

Push certificates from your Application to AWS Certificate Manager (ACM). Certificates synced to ACM can be used with Elastic Load Balancers, CloudFront, API Gateway, and other AWS services.

Certificate Syncs are configured per Application. First select which certificates to sync, then configure the ACM destination.

Prerequisites

An AWS Connection with the following ACM permissions:
- acm:ListCertificates
- acm:DescribeCertificate
- acm:ImportCertificate
- acm:DeleteCertificate
- acm:ListTagsForCertificate

Certificates synced to ACM are stored as imported certificates, preserving both the certificate and private key.

Create an ACM Sync

Infisical UI
API

In your Application, go to the Certificate Syncs tab and click Create Sync.
Select the AWS Certificate Manager option.
Configure the Destination:
- AWS Connection: The AWS Connection to authenticate with.
- AWS Region: The AWS region where certificates should be stored.
Configure the Sync Options:
- Enable Removal of Expired/Revoked Certificates: Remove certificates from the destination if they are no longer active in Infisical.
- Preserve ARN on Renewal: Sync renewed certificates under the same ARN instead of creating a new one.
- Include Root CA: Include the Root CA certificate in the certificate chain.
- Certificate Name Schema: Customize certificate tags. Must include {{certificateId}}. Defaults to Infisical-{{certificateId}}.
- Auto-Sync Enabled: Automatically sync certificates when changes occur.
Configure the Details:
- Name: The name of your sync (slug-friendly).
- Description: Optional description.
Select which certificates should be synced.
Review and click Create Sync.

To create an AWS Certificate Manager Certificate Sync, make an API request to the Create AWS Certificate Manager Certificate Sync API endpoint.

Sample request

You can optionally specify certificateIds during sync creation to immediately add certificates to the sync. If not provided, you can add certificates later using the certificate management endpoints.

Request

curl --request POST \
--url https://app.infisical.com/api/v1/cert-manager/syncs/aws-certificate-manager \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data '{
    "name": "my-acm-cert-sync",
    "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "description": "an example certificate sync",
    "connectionId": "550e8400-e29b-41d4-a716-446655440000",
    "destination": "aws-certificate-manager",
    "isAutoSyncEnabled": true,
    "certificateIds": [
        "550e8400-e29b-41d4-a716-446655440000",
        "660f1234-e29b-41d4-a716-446655440001"
    ],
    "syncOptions": {
        "canRemoveCertificates": true,
        "preserveArnOnRenewal": true,
        "includeRootCa": false,
        "certificateNameSchema": "myapp-{{certificateId}}"
    },
    "destinationConfig": {
        "region": "us-east-1"
    }
}'

Sample response

Response

{
    "pkiSync": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "name": "my-acm-cert-sync",
        "description": "an example certificate sync",
        "destination": "aws-certificate-manager",
        "isAutoSyncEnabled": true,
        "destinationConfig": {
            "region": "us-east-1"
        },
        "syncOptions": {
            "canRemoveCertificates": true,
            "preserveArnOnRenewal": true,
            "includeRootCa": false,
            "certificateNameSchema": "myapp-{{certificateId}}"
        },
        "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "connectionId": "550e8400-e29b-41d4-a716-446655440000",
        "createdAt": "2023-01-01T00:00:00.000Z",
        "updatedAt": "2023-01-01T00:00:00.000Z"
    }
}

Certificate Management

The AWS Certificate Manager Certificate Sync provides:

Automatic Deployment: Deploy certificates in Infisical to AWS Certificate Manager.
Certificate Updates: Update certificates in AWS Certificate Manager when renewals occur.
Expiration Handling: Optionally remove expired certificates from AWS Certificate Manager (if enabled).
Tagging: Automatically tag certificates with an InfisicalCertificate tag for easy identification and management.

AWS Certificate Manager Certificate Syncs support both automatic and manual synchronization modes. When auto-sync is enabled, certificates are automatically deployed as they are issued or renewed.

Manual Certificate Sync

You can manually trigger certificate synchronization to AWS Certificate Manager using the sync certificates functionality. This is useful for:

Initial setup when you have existing certificates to deploy
One-time sync of specific certificates
Testing certificate sync configurations
Force sync after making changes

To manually sync certificates, use the Sync Certificates API endpoint or the manual sync option in the Infisical UI.

FAQ

Can I import certificates from AWS Certificate Manager back into Infisical?

AWS Certificate Manager does not support importing certificates back into Infisical due to security limitations where private keys cannot be extracted from AWS Certificate Manager. Only certificates imported into ACM (not AWS-issued certificates) can be managed by the sync.

What’s Next?

AWS Elastic Load Balancer

Deploy certificates directly to ALB/NLB listeners.

Auto-Renewal

Enable automatic certificate renewal and syncing.

Alerting

Get notified about certificate lifecycle events.

Other Sync Destinations

View all supported sync destinations.

Certificate Management

Product Reference

Reference

AWS Certificate Manager

Prerequisites

Create an ACM Sync

Sample request

Sample response

Certificate Management

Manual Certificate Sync

FAQ

What’s Next?

AWS Elastic Load Balancer

Auto-Renewal

Alerting

Other Sync Destinations

Certificate Management

Product Reference

Reference

Documentation Index

​Prerequisites

​Create an ACM Sync

​Sample request

​Sample response

​Certificate Management

​Manual Certificate Sync

​FAQ

​What’s Next?

AWS Elastic Load Balancer

Auto-Renewal

Alerting

Other Sync Destinations

Prerequisites

Create an ACM Sync

Sample request

Sample response

Certificate Management

Manual Certificate Sync

FAQ

What’s Next?