aws-cdk-lib.aws_certificatemanager

AWS Certificate Manager Construct Library

AWS Certificate Manager (ACM) handles the complexity of creating, storing, and renewing public and private SSL/TLS X.509 certificates and keys that protect your AWS websites and applications. ACM certificates can secure singular domain names, multiple specific domain names, wildcard domains, or combinations of these. ACM wildcard certificates can protect an unlimited number of subdomains.

This package provides Constructs for provisioning and referencing ACM certificates which can be used with CloudFront and ELB.

After requesting a certificate, you will need to prove that you own the domain in question before the certificate will be granted. The CloudFormation deployment will wait until this verification process has been completed.

Because of this wait time, when using manual validation methods, it's better to provision your certificates either in a separate stack from your main service, or provision them manually and import them into your CDK application.

Note: There is a limit on total number of ACM certificates that can be requested on an account and region within a year. The default limit is 2000, but this limit may be (much) lower on new AWS accounts. See https://docs.aws.amazon.com/acm/latest/userguide/acm-limits.html for more information.

DNS validation

DNS validation is the preferred method to validate domain ownership, as it has a number of advantages over email validation. See also Validate with DNS in the AWS Certificate Manager User Guide.

If Amazon Route 53 is your DNS provider for the requested domain, the DNS record can be created automatically:

const myHostedZone = new route53.HostedZone(this, 'HostedZone', {
  zoneName: 'example.com',
});
new acm.Certificate(this, 'Certificate', {
  domainName: 'hello.example.com',
  certificateName: 'Hello World Service', // Optionally provide an certificate name
  validation: acm.CertificateValidation.fromDns(myHostedZone),
});

my_hosted_zone = route53.HostedZone(self, "HostedZone",
    zone_name="example.com"
)
acm.Certificate(self, "Certificate",
    domain_name="hello.example.com",
    certificate_name="Hello World Service",  # Optionally provide an certificate name
    validation=acm.CertificateValidation.from_dns(my_hosted_zone)
)

HostedZone myHostedZone = HostedZone.Builder.create(this, "HostedZone")
        .zoneName("example.com")
        .build();
Certificate.Builder.create(this, "Certificate")
        .domainName("hello.example.com")
        .certificateName("Hello World Service") // Optionally provide an certificate name
        .validation(CertificateValidation.fromDns(myHostedZone))
        .build();

var myHostedZone = new HostedZone(this, "HostedZone", new HostedZoneProps {
    ZoneName = "example.com"
});
new Certificate(this, "Certificate", new CertificateProps {
    DomainName = "hello.example.com",
    CertificateName = "Hello World Service",  // Optionally provide an certificate name
    Validation = CertificateValidation.FromDns(myHostedZone)
});

myHostedZone := route53.NewHostedZone(this, jsii.String("HostedZone"), &HostedZoneProps{
	ZoneName: jsii.String("example.com"),
})
acm.NewCertificate(this, jsii.String("Certificate"), &CertificateProps{
	DomainName: jsii.String("hello.example.com"),
	CertificateName: jsii.String("Hello World Service"),
	 // Optionally provide an certificate name
	Validation: acm.CertificateValidation_FromDns(myHostedZone),
})

If Route 53 is not your DNS provider, the DNS records must be added manually and the stack will not complete creating until the records are added.

new acm.Certificate(this, 'Certificate', {
  domainName: 'hello.example.com',
  validation: acm.CertificateValidation.fromDns(), // Records must be added manually
});

acm.Certificate(self, "Certificate",
    domain_name="hello.example.com",
    validation=acm.CertificateValidation.from_dns()
)

Certificate.Builder.create(this, "Certificate")
        .domainName("hello.example.com")
        .validation(CertificateValidation.fromDns())
        .build();

new Certificate(this, "Certificate", new CertificateProps {
    DomainName = "hello.example.com",
    Validation = CertificateValidation.FromDns()
});

acm.NewCertificate(this, jsii.String("Certificate"), &CertificateProps{
	DomainName: jsii.String("hello.example.com"),
	Validation: acm.CertificateValidation_FromDns(),
})

When working with multiple domains, use the CertificateValidation.fromDnsMultiZone():

const exampleCom = new route53.HostedZone(this, 'ExampleCom', {
  zoneName: 'example.com',
});
const exampleNet = new route53.HostedZone(this, 'ExampleNet', {
  zoneName: 'example.net',
});

const cert = new acm.Certificate(this, 'Certificate', {
  domainName: 'test.example.com',
  subjectAlternativeNames: ['cool.example.com', 'test.example.net'],
  validation: acm.CertificateValidation.fromDnsMultiZone({
    'test.example.com': exampleCom,
    'cool.example.com': exampleCom,
    'test.example.net': exampleNet,
  }),
});

example_com = route53.HostedZone(self, "ExampleCom",
    zone_name="example.com"
)
example_net = route53.HostedZone(self, "ExampleNet",
    zone_name="example.net"
)

cert = acm.Certificate(self, "Certificate",
    domain_name="test.example.com",
    subject_alternative_names=["cool.example.com", "test.example.net"],
    validation=acm.CertificateValidation.from_dns_multi_zone({
        "test.example.com": example_com,
        "cool.example.com": example_com,
        "test.example.net": example_net
    })
)

HostedZone exampleCom = HostedZone.Builder.create(this, "ExampleCom")
        .zoneName("example.com")
        .build();
HostedZone exampleNet = HostedZone.Builder.create(this, "ExampleNet")
        .zoneName("example.net")
        .build();

Certificate cert = Certificate.Builder.create(this, "Certificate")
        .domainName("test.example.com")
        .subjectAlternativeNames(List.of("cool.example.com", "test.example.net"))
        .validation(CertificateValidation.fromDnsMultiZone(Map.of(
                "test.example.com", exampleCom,
                "cool.example.com", exampleCom,
                "test.example.net", exampleNet)))
        .build();

var exampleCom = new HostedZone(this, "ExampleCom", new HostedZoneProps {
    ZoneName = "example.com"
});
var exampleNet = new HostedZone(this, "ExampleNet", new HostedZoneProps {
    ZoneName = "example.net"
});

var cert = new Certificate(this, "Certificate", new CertificateProps {
    DomainName = "test.example.com",
    SubjectAlternativeNames = new [] { "cool.example.com", "test.example.net" },
    Validation = CertificateValidation.FromDnsMultiZone(new Dictionary<string, IHostedZone> {
        { "test.example.com", exampleCom },
        { "cool.example.com", exampleCom },
        { "test.example.net", exampleNet }
    })
});

exampleCom := route53.NewHostedZone(this, jsii.String("ExampleCom"), &HostedZoneProps{
	ZoneName: jsii.String("example.com"),
})
exampleNet := route53.NewHostedZone(this, jsii.String("ExampleNet"), &HostedZoneProps{
	ZoneName: jsii.String("example.net"),
})

cert := acm.NewCertificate(this, jsii.String("Certificate"), &CertificateProps{
	DomainName: jsii.String("test.example.com"),
	SubjectAlternativeNames: []*string{
		jsii.String("cool.example.com"),
		jsii.String("test.example.net"),
	},
	Validation: acm.CertificateValidation_FromDnsMultiZone(map[string]IHostedZone{
		"test.example.com": exampleCom,
		"cool.example.com": exampleCom,
		"test.example.net": exampleNet,
	}),
})

Email validation

Email-validated certificates (the default) are validated by receiving an email on one of a number of predefined domains and following the instructions in the email.

See Validate with Email in the AWS Certificate Manager User Guide.

new acm.Certificate(this, 'Certificate', {
  domainName: 'hello.example.com',
  validation: acm.CertificateValidation.fromEmail(), // Optional, this is the default
});

acm.Certificate(self, "Certificate",
    domain_name="hello.example.com",
    validation=acm.CertificateValidation.from_email()
)

Certificate.Builder.create(this, "Certificate")
        .domainName("hello.example.com")
        .validation(CertificateValidation.fromEmail())
        .build();

new Certificate(this, "Certificate", new CertificateProps {
    DomainName = "hello.example.com",
    Validation = CertificateValidation.FromEmail()
});

acm.NewCertificate(this, jsii.String("Certificate"), &CertificateProps{
	DomainName: jsii.String("hello.example.com"),
	Validation: acm.CertificateValidation_FromEmail(),
})

Cross-region Certificates

ACM certificates that are used with CloudFront -- or higher-level constructs which rely on CloudFront -- must be in the us-east-1 region. CloudFormation allows you to create a Stack with a CloudFront distribution in any region. In order to create an ACM certificate in us-east-1 and reference it in a CloudFront distribution is a different region, it is recommended to perform a multi stack deployment.

Enable the Stack property crossRegionReferences in order to access the cross stack/region certificate.

This feature is currently experimental

import { aws_cloudfront as cloudfront, aws_cloudfront_origins as origins } from 'aws-cdk-lib';
declare const app: App;

const stack1 = new Stack(app, 'Stack1', {
  env: {
    region: 'us-east-1',
  },
  crossRegionReferences: true,
});
const cert = new acm.Certificate(stack1, 'Cert', {
  domainName: '*.example.com',
  validation: acm.CertificateValidation.fromDns(PublicHostedZone.fromHostedZoneId(stack1, 'Zone', 'ZONE_ID')),
});

const stack2 = new Stack(app, 'Stack2', {
  env: {
    region: 'us-east-2',
  },
  crossRegionReferences: true,
});

new cloudfront.Distribution(stack2, 'Distribution', {
  defaultBehavior: {
    origin: new origins.HttpOrigin('example.com'),
  },
  domainNames: ['dev.example.com'],
  certificate: cert,
});

from aws_cdk import Environment, Environment
from aws_cdk import aws_cloudfront as cloudfront, aws_cloudfront_origins as origins
# app: App


stack1 = Stack(app, "Stack1",
    env=Environment(
        region="us-east-1"
    ),
    cross_region_references=True
)
cert = acm.Certificate(stack1, "Cert",
    domain_name="*.example.com",
    validation=acm.CertificateValidation.from_dns(PublicHostedZone.from_hosted_zone_id(stack1, "Zone", "ZONE_ID"))
)

stack2 = Stack(app, "Stack2",
    env=Environment(
        region="us-east-2"
    ),
    cross_region_references=True
)

cloudfront.Distribution(stack2, "Distribution",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.HttpOrigin("example.com")
    ),
    domain_names=["dev.example.com"],
    certificate=cert
)

import software.amazon.awscdk.services.cloudfront.*;
import software.amazon.awscdk.services.cloudfront.origins.*;
App app;


Stack stack1 = Stack.Builder.create(app, "Stack1")
        .env(Environment.builder()
                .region("us-east-1")
                .build())
        .crossRegionReferences(true)
        .build();
Certificate cert = Certificate.Builder.create(stack1, "Cert")
        .domainName("*.example.com")
        .validation(CertificateValidation.fromDns(PublicHostedZone.fromHostedZoneId(stack1, "Zone", "ZONE_ID")))
        .build();

Stack stack2 = Stack.Builder.create(app, "Stack2")
        .env(Environment.builder()
                .region("us-east-2")
                .build())
        .crossRegionReferences(true)
        .build();

Distribution.Builder.create(stack2, "Distribution")
        .defaultBehavior(BehaviorOptions.builder()
                .origin(new HttpOrigin("example.com"))
                .build())
        .domainNames(List.of("dev.example.com"))
        .certificate(cert)
        .build();

using Amazon.CDK.AWS.CloudFront;
using Amazon.CDK.AWS.CloudFront.Origins;
App app;


var stack1 = new Stack(app, "Stack1", new StackProps {
    Env = new Environment {
        Region = "us-east-1"
    },
    CrossRegionReferences = true
});
var cert = new Certificate(stack1, "Cert", new CertificateProps {
    DomainName = "*.example.com",
    Validation = CertificateValidation.FromDns(PublicHostedZone.FromHostedZoneId(stack1, "Zone", "ZONE_ID"))
});

var stack2 = new Stack(app, "Stack2", new StackProps {
    Env = new Environment {
        Region = "us-east-2"
    },
    CrossRegionReferences = true
});

new Distribution(stack2, "Distribution", new DistributionProps {
    DefaultBehavior = new BehaviorOptions {
        Origin = new HttpOrigin("example.com")
    },
    DomainNames = new [] { "dev.example.com" },
    Certificate = cert
});

import "github.com/aws/aws-cdk-go/awscdk"
var app App


stack1 := awscdk.Newstack(app, jsii.String("Stack1"), &StackProps{
	Env: &Environment{
		Region: jsii.String("us-east-1"),
	},
	CrossRegionReferences: jsii.Boolean(true),
})
cert := acm.NewCertificate(stack1, jsii.String("Cert"), &CertificateProps{
	DomainName: jsii.String("*.example.com"),
	Validation: acm.CertificateValidation_FromDns(awscdk.PublicHostedZone_FromHostedZoneId(stack1, jsii.String("Zone"), jsii.String("ZONE_ID"))),
})

stack2 := awscdk.Newstack(app, jsii.String("Stack2"), &StackProps{
	Env: &Environment{
		Region: jsii.String("us-east-2"),
	},
	CrossRegionReferences: jsii.Boolean(true),
})

awscdk.Aws_cloudfront.NewDistribution(stack2, jsii.String("Distribution"), &DistributionProps{
	DefaultBehavior: &BehaviorOptions{
		Origin: awscdk.Aws_cloudfront_origins.NewHttpOrigin(jsii.String("example.com")),
	},
	DomainNames: []*string{
		jsii.String("dev.example.com"),
	},
	Certificate: cert,
})

Requesting private certificates

AWS Certificate Manager can create private certificates issued by Private Certificate Authority (PCA). Validation of private certificates is not necessary.

import * as acmpca from 'aws-cdk-lib/aws-acmpca';

new acm.PrivateCertificate(this, 'PrivateCertificate', {
  domainName: 'test.example.com',
  subjectAlternativeNames: ['cool.example.com', 'test.example.net'], // optional
  certificateAuthority: acmpca.CertificateAuthority.fromCertificateAuthorityArn(this, 'CA',
    'arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77'),
  keyAlgorithm: acm.KeyAlgorithm.RSA_2048, // optional, default algorithm is RSA_2048
});

import aws_cdk.aws_acmpca as acmpca


acm.PrivateCertificate(self, "PrivateCertificate",
    domain_name="test.example.com",
    subject_alternative_names=["cool.example.com", "test.example.net"],  # optional
    certificate_authority=acmpca.CertificateAuthority.from_certificate_authority_arn(self, "CA", "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77"),
    key_algorithm=acm.KeyAlgorithm.RSA_2048
)

import software.amazon.awscdk.services.acmpca.*;


PrivateCertificate.Builder.create(this, "PrivateCertificate")
        .domainName("test.example.com")
        .subjectAlternativeNames(List.of("cool.example.com", "test.example.net")) // optional
        .certificateAuthority(CertificateAuthority.fromCertificateAuthorityArn(this, "CA", "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77"))
        .keyAlgorithm(KeyAlgorithm.RSA_2048)
        .build();

using Amazon.CDK.AWS.ACMPCA;


new PrivateCertificate(this, "PrivateCertificate", new PrivateCertificateProps {
    DomainName = "test.example.com",
    SubjectAlternativeNames = new [] { "cool.example.com", "test.example.net" },  // optional
    CertificateAuthority = CertificateAuthority.FromCertificateAuthorityArn(this, "CA", "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77"),
    KeyAlgorithm = KeyAlgorithm.RSA_2048
});

import acmpca "github.com/aws/aws-cdk-go/awscdk"


acm.NewPrivateCertificate(this, jsii.String("PrivateCertificate"), &PrivateCertificateProps{
	DomainName: jsii.String("test.example.com"),
	SubjectAlternativeNames: []*string{
		jsii.String("cool.example.com"),
		jsii.String("test.example.net"),
	},
	 // optional
	CertificateAuthority: acmpca.CertificateAuthority_FromCertificateAuthorityArn(this, jsii.String("CA"), jsii.String("arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/023077d8-2bfa-4eb0-8f22-05c96deade77")),
	KeyAlgorithm: acm.KeyAlgorithm_RSA_2048(),
})

Requesting public SSL/TLS certificates exportable to use anywhere

AWS Certificate Manager can issue an exportable public certificate. There is a charge at certificate issuance and again when the certificate renews. See AWS Certificate Manager exportable public certificates for details.

new acm.Certificate(this, 'Certificate', {
  domainName: 'test.example.com',
  allowExport: true,
});

acm.Certificate(self, "Certificate",
    domain_name="test.example.com",
    allow_export=True
)

Certificate.Builder.create(this, "Certificate")
        .domainName("test.example.com")
        .allowExport(true)
        .build();

new Certificate(this, "Certificate", new CertificateProps {
    DomainName = "test.example.com",
    AllowExport = true
});

acm.NewCertificate(this, jsii.String("Certificate"), &CertificateProps{
	DomainName: jsii.String("test.example.com"),
	AllowExport: jsii.Boolean(true),
})

Requesting certificates without transparency logging

Transparency logging can be opted out of for AWS Certificate Manager certificates. See opting out of certificate transparency logging for limits.

new acm.Certificate(this, 'Certificate', {
  domainName: 'test.example.com',
  transparencyLoggingEnabled: false,
});

acm.Certificate(self, "Certificate",
    domain_name="test.example.com",
    transparency_logging_enabled=False
)

Certificate.Builder.create(this, "Certificate")
        .domainName("test.example.com")
        .transparencyLoggingEnabled(false)
        .build();

new Certificate(this, "Certificate", new CertificateProps {
    DomainName = "test.example.com",
    TransparencyLoggingEnabled = false
});

acm.NewCertificate(this, jsii.String("Certificate"), &CertificateProps{
	DomainName: jsii.String("test.example.com"),
	TransparencyLoggingEnabled: jsii.Boolean(false),
})

Key Algorithms

To specify the algorithm of the public and private key pair that your certificate uses to encrypt data use the keyAlgorithm property.

Algorithms supported for an ACM certificate request include:

• RSA_2048
• EC_prime256v1
• EC_secp384r1

new acm.Certificate(this, 'Certificate', {
  domainName: 'test.example.com',
  keyAlgorithm: acm.KeyAlgorithm.EC_PRIME256V1,
});

acm.Certificate(self, "Certificate",
    domain_name="test.example.com",
    key_algorithm=acm.KeyAlgorithm.EC_PRIME256V1
)

Certificate.Builder.create(this, "Certificate")
        .domainName("test.example.com")
        .keyAlgorithm(KeyAlgorithm.EC_PRIME256V1)
        .build();

new Certificate(this, "Certificate", new CertificateProps {
    DomainName = "test.example.com",
    KeyAlgorithm = KeyAlgorithm.EC_PRIME256V1
});

acm.NewCertificate(this, jsii.String("Certificate"), &CertificateProps{
	DomainName: jsii.String("test.example.com"),
	KeyAlgorithm: acm.KeyAlgorithm_EC_PRIME256V1(),
})

Visit Key algorithms for more details.

Importing

If you want to import an existing certificate, you can do so from its ARN:

const arn = 'arn:aws:...';
const certificate = acm.Certificate.fromCertificateArn(this, 'Certificate', arn);

arn = "arn:aws:..."
certificate = acm.Certificate.from_certificate_arn(self, "Certificate", arn)

String arn = "arn:aws:...";
ICertificate certificate = Certificate.fromCertificateArn(this, "Certificate", arn);

var arn = "arn:aws:...";
var certificate = Certificate.FromCertificateArn(this, "Certificate", arn);

arn := "arn:aws:..."
certificate := acm.Certificate_FromCertificateArn(this, jsii.String("Certificate"), arn)

Sharing between Stacks

To share the certificate between stacks in the same CDK application, simply pass the Certificate object between the stacks.

Metrics

The DaysToExpiry metric is available via the metricDaysToExpiry method for all certificates. This metric is emitted by AWS Certificates Manager once per day until the certificate has effectively expired.

An alarm can be created to determine whether a certificate is soon due for renewal using the following code:

import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';

declare const myHostedZone: route53.HostedZone;
const certificate = new acm.Certificate(this, 'Certificate', {
  domainName: 'hello.example.com',
  validation: acm.CertificateValidation.fromDns(myHostedZone),
});
certificate.metricDaysToExpiry().createAlarm(this, 'Alarm', {
  comparisonOperator: cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
  evaluationPeriods: 1,
  threshold: 45, // Automatic rotation happens between 60 and 45 days before expiry
});

import aws_cdk.aws_cloudwatch as cloudwatch

# my_hosted_zone: route53.HostedZone

certificate = acm.Certificate(self, "Certificate",
    domain_name="hello.example.com",
    validation=acm.CertificateValidation.from_dns(my_hosted_zone)
)
certificate.metric_days_to_expiry().create_alarm(self, "Alarm",
    comparison_operator=cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
    evaluation_periods=1,
    threshold=45
)

import software.amazon.awscdk.services.cloudwatch.*;

HostedZone myHostedZone;

Certificate certificate = Certificate.Builder.create(this, "Certificate")
        .domainName("hello.example.com")
        .validation(CertificateValidation.fromDns(myHostedZone))
        .build();
certificate.metricDaysToExpiry().createAlarm(this, "Alarm", CreateAlarmOptions.builder()
        .comparisonOperator(ComparisonOperator.LESS_THAN_THRESHOLD)
        .evaluationPeriods(1)
        .threshold(45)
        .build());

using Amazon.CDK.AWS.CloudWatch;

HostedZone myHostedZone;

var certificate = new Certificate(this, "Certificate", new CertificateProps {
    DomainName = "hello.example.com",
    Validation = CertificateValidation.FromDns(myHostedZone)
});
certificate.MetricDaysToExpiry().CreateAlarm(this, "Alarm", new CreateAlarmOptions {
    ComparisonOperator = ComparisonOperator.LESS_THAN_THRESHOLD,
    EvaluationPeriods = 1,
    Threshold = 45
});

import cloudwatch "github.com/aws/aws-cdk-go/awscdk"

var myHostedZone HostedZone

certificate := acm.NewCertificate(this, jsii.String("Certificate"), &CertificateProps{
	DomainName: jsii.String("hello.example.com"),
	Validation: acm.CertificateValidation_FromDns(myHostedZone),
})
certificate.metricDaysToExpiry().CreateAlarm(this, jsii.String("Alarm"), &CreateAlarmOptions{
	ComparisonOperator: cloudwatch.ComparisonOperator_LESS_THAN_THRESHOLD,
	EvaluationPeriods: jsii.Number(1),
	Threshold: jsii.Number(45),
})

Types

Name	Kind	Summary
Certificate	Construct (L2)	A certificate managed by AWS Certificate Manager.
DnsValidatedCertificate	Construct (L2)	A certificate managed by AWS Certificate Manager.
PrivateCertificate	Construct (L2)	A private certificate managed by AWS Certificate Manager.
CfnAccount	Construct (L1)	The AWS::CertificateManager::Account resource defines the expiry event configuration that determines the number of days prior to expiry when ACM starts generating EventBridge events.
CfnAcmeDomainValidation	Construct (L1)	Resource Type definition for AWS::CertificateManager::AcmeDomainValidation.
CfnAcmeEndpoint	Construct (L1)	Resource Type definition for AWS::CertificateManager::AcmeEndpoint.
CfnAcmeExternalAccountBinding	Construct (L1)	Resource Type definition for AWS::CertificateManager::AcmeExternalAccountBinding.
CfnCertificate	Construct (L1)	The AWS::CertificateManager::Certificate resource requests an Certificate Manager ( ACM ) certificate that you can use to enable secure connections.
CertificateProps	Struct	Properties for your certificate.
CertificateValidation	Class	How to validate a certificate.
CertificationValidationProps	Struct	Properties for certificate validation.
CfnAccount.ExpiryEventsConfigurationProperty	Struct	Object containing expiration events options associated with an AWS account .
CfnAccountProps	Struct	Properties for defining a CfnAccount.
CfnAcmeDomainValidation.DnsPrevalidationOptionsProperty	Struct	DNS-based prevalidation options for the domain validation.
CfnAcmeDomainValidation.DomainScopeProperty	Struct	Controls which certificate types are authorized to be issued for the domain via the ACME endpoint.
CfnAcmeDomainValidation.PrevalidationOptionsProperty	Struct	Prevalidation method configuration.
CfnAcmeDomainValidation.TagsItemsProperty	Struct
CfnAcmeDomainValidationProps	Struct	Properties for defining a CfnAcmeDomainValidation.
CfnAcmeEndpoint.CertificateAuthorityProperty	Struct	The certificate authority configuration for the ACME endpoint.
CfnAcmeEndpoint.PublicCertificateAuthorityProperty	Struct	Configuration for the public certificate authority.
CfnAcmeEndpoint.TagsItemsProperty	Struct
CfnAcmeEndpointProps	Struct	Properties for defining a CfnAcmeEndpoint.
CfnAcmeExternalAccountBinding.ExpirationProperty	Struct	The expiration configuration for the external account binding.
CfnAcmeExternalAccountBinding.TagsItemsProperty	Struct
CfnAcmeExternalAccountBindingProps	Struct	Properties for defining a CfnAcmeExternalAccountBinding.
CfnCertificate.DomainValidationOptionProperty	Struct	DomainValidationOption is a property of the AWS::CertificateManager::Certificate resource that specifies the Certificate Manager ( ACM ) certificate domain to validate. Depending on the chosen validation method, ACM checks the domain's DNS record for a validation CNAME, or it attempts to send a validation email message to the domain owner.
CfnCertificateProps	Struct	Properties for defining a CfnCertificate.
DnsValidatedCertificateProps	Struct	Properties to create a DNS validated certificate managed by AWS Certificate Manager.
ICertificate	Interface	Represents a certificate in AWS Certificate Manager.
KeyAlgorithm	Class	Certificate Manager key algorithm.
PrivateCertificateProps	Struct	Properties for your private certificate.
ValidationMethod	Enum	Method used to assert ownership of the domain.