AWS Certificate Manager vs Let's Encrypt
AWS Certificate Manager
aws.amazon.comLet's Encrypt
letsencrypt.orgSide by side
| Figure | AWS Certificate Manager | Let's Encrypt |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 3 | 3 |
| Spec score · Certificate Management Software | 7.7 (#16) | 8.6 (#5) |
| Certificate types | ACM supports certificates for singular domain names, multiple specific domain names, wildcard domains, or combinations of these. | The service issues standard Domain Validation certificates for domain-based servers, including web, mail and FTP servers. |
| Integrations | ACM integrates with Elastic Load Balancing, Amazon CloudFront, Amazon API Gateway, AWS Elastic Beanstalk, and AWS CloudFormation for public certificates. | Hosting providers can obtain and manage certificates for customers through their own ACME clients. |
Plans
AWS Certificate Manager
- Public certificate for integrated AWS servicesFree
- ACME public certificatesPrice not published
- Exportable public certificatesPrice not published
Let's Encrypt
- Let's Encrypt certificatesFree
- Let's Encrypt certificatesFree
- Short-lived certificatesFree
In their own words
AWS Certificate Manager
AWS Certificate Manager (ACM) provisions, manages and deploys public and private SSL/TLS certificates for AWS, hybrid and multicloud workloads. Certificates may cover one domain, multiple named domains, wildcard domains or combinations. Management is available through the AWS Management Console, AWS CLI and ACM APIs, with usage auditable in AWS CloudTrail logs. Amazon-issued certificates can renew automatically when DNS validation is used; otherwise ACM sends notices as expiration approaches. Public-certificate integrations include Elastic Load Balancing, Amazon CloudFront, Amazon API Gateway, AWS Elastic Beanstalk and AWS CloudFormation. AWS Key Management Service helps protect stored private keys. Customers can import third-party CA certificates and deploy them with Elastic Load Balancers, CloudFront and API Gateway; importing costs nothing. The default quota is 10 domain names per certificate, with requests up to 100. The integrated-services public-certificate plan is free and non-exportable. ACM is available on web and API platforms.
Let's Encrypt
Let’s Encrypt is a global Certificate Authority that provides SSL/TLS certificates for HTTPS connections. The ACME protocol verifies control of a domain, and compatible clients can automate issuance, management, and renewal. Its client directory includes Apache HTTP Server, Caddy, nginx, Kubernetes, Docker, and Windows/IIS environments. Certificates are Domain Validation only; Let’s Encrypt says it does not plan to issue Organization Validation or Extended Validation certificates. Wildcard certificates are available through the DNS-01 challenge. Standard certificates last 90 days, with an optional six-day lifetime; these periods cannot be adjusted. Subscribers generate and manage private keys on their own servers. Issued and revoked certificates are publicly recorded, and the service says its certificates are trusted by most browsers and operating systems. Certificates cost nothing. A registered domain can receive up to 50 certificates every seven days under published rate limits. Direct subscriber support is not offered.