AWS Certificate Manager vs lego
AWS Certificate Manager
aws.amazon.com
lego
go-acme.github.ioSide by side
| Figure | AWS Certificate Manager | lego |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 3 | 1 |
| Spec score · Certificate Management Software | 7.7 (#16) | 8.5 (#6) |
| Certificate management | Certificates can be centrally managed from the AWS Management Console, AWS CLI, or ACM APIs, and their use can be audited through AWS CloudTrail logs. | It can obtain, renew, and revoke certificates. |
| Certificate types | ACM supports certificates for singular domain names, multiple specific domain names, wildcard domains, or combinations of these. | It supports wildcard and SAN certificates. |
| Purpose | AWS Certificate Manager provisions, manages, and deploys public and private SSL/TLS certificates for AWS, hybrid, and multicloud workloads. | lego is an ACME client and library written in Go for obtaining and renewing certificates. |
Plans
AWS Certificate Manager
- Public certificate for integrated AWS servicesFree
- ACME public certificatesPrice not published
- Exportable public certificatesPrice not published
In their own words
AWS Certificate Manager
AWS Certificate Manager (ACM) provisions, manages and deploys public and private SSL/TLS certificates for AWS, hybrid and multicloud workloads. Certificates may cover one domain, multiple named domains, wildcard domains or combinations. Management is available through the AWS Management Console, AWS CLI and ACM APIs, with usage auditable in AWS CloudTrail logs. Amazon-issued certificates can renew automatically when DNS validation is used; otherwise ACM sends notices as expiration approaches. Public-certificate integrations include Elastic Load Balancing, Amazon CloudFront, Amazon API Gateway, AWS Elastic Beanstalk and AWS CloudFormation. AWS Key Management Service helps protect stored private keys. Customers can import third-party CA certificates and deploy them with Elastic Load Balancers, CloudFront and API Gateway; importing costs nothing. The default quota is 10 domain names per certificate, with requests up to 100. The integrated-services public-certificate plan is free and non-exportable. ACM is available on web and API platforms.
lego
lego is an independent, free, open-source ACME client and Go library for obtaining, renewing, and revoking certificates. It supports wildcard and SAN certificates and can work with multiple ACME servers, including Let’s Encrypt and ZeroSSL. Validation choices include DNS-01, HTTP-01, TLS-ALPN-01, and DNS-PERSIST-01. The project lists more than 200 DNS providers, including Cloudflare, Amazon Route 53, Google Cloud DNS, and Azure DNS, with CNAME support enabled by default. Users can run lego from the command line or call it as a Go library. DNS credentials and settings are supplied through environment variables, with file references and dotenv files supported. Installation options include prebuilt binaries, Docker, package managers, and source. The maintainers look after the AUR and Snap packages; other listed packages are community maintained. The project lists support for ACME RFC 8555 and certificate validation and renewal extensions. It is licensed under MIT, and installing from source requires Go 1.25 or later. The project points to GitHub issues and discussions for help.