Certificates and Machine Identity

Certificate management is becoming increasingly important because modern enterprises have far more machine identities than human identities.

These can include:

Applications
APIs
Containers
Microservices
Servers
Devices
CI/CD Pipelines
AI Agents

Each machine may need to prove its identity before accessing another service.

Certificates provide one mechanism for establishing this trust.

For example:

AI Agent
   │
   │ Certificate
   ▼
API Gateway
   │
   │ Verify Identity
   ▼
Authorized API

Certificate lifecycle management therefore becomes part of the broader machine identity security architecture.

ACM vs Custom PKI

The fundamental difference is management responsibility and control.

Area	AWS ACM	Custom / Enterprise PKI
Certificate provisioning	Highly automated	Organization controls
Renewal	Automated for eligible managed certificates	Must be designed/automated
Private key management	Managed for ACM-issued certificates	Organization controls
Public website certificates	Excellent fit	Possible, but more operational work
Internal certificates	Private CA options available	Highly customizable
Multi-cloud	Primarily AWS-centric integrations	Can span environments
Certificate policies	Simplified	Highly customizable
Operational complexity	Lower	Higher
Control	AWS-managed	Organization-managed

The choice is therefore not necessarily ACM or PKI.

Large enterprises often use both.

ACM vs Custom PKI: The Simple Rule

A useful starting point is:

Use ACM when AWS can manage the certificate lifecycle for you. Use private or custom PKI when you need broader control over identities, trust, policies, or certificate deployment.

For many enterprises, the final architecture is hybrid:

                 Certificate Strategy
                         │
             ┌───────────┴───────────┐
             │                       │
             ▼                       ▼
            ACM               Enterprise PKI
             │                       │
             ▼                       ▼
      AWS Public TLS        Internal / Machine
                              Identities

The goal isn’t simply to issue certificates.

The goal is to make the entire certificate lifecycle:

Discoverable → Policy-controlled → Automated → Monitored → Renewable → Auditable

That is what turns TLS certificates from individual configuration objects into a manageable enterprise security capability.