Iis – Can an AWS Certificate Manager SSL certificate be installed on EC2 in IIS

Q: Can I use certificates on Amazon EC2 instances or on my own servers?

No. At this time, certificates provided by ACM can only be used with specific AWS services.

---

Q: With which AWS services can I use certificates provided by ACM?

You can use ACM with the following AWS services:

• Elastic Load Balancing

• Amazon CloudFront

• AWS Elastic Beanstalk

• Amazon API Gateway

• AWS CloudFormation

https://aws.amazon.com/certificate-manager/faqs/

The certificates created by Amazon Certificate Manager (ACM) have corresponding private keys that are stored securely within the AWS infrastructure and are not accessible to you... which means you can't deploy these certs directly on systems you have direct access to, like EC2 servers.

You can only use them on services front-ended by Elastic Load Balancer, CloudFront, or both. As CloudFront, unlike ELB, has no monthly baseline cost, it seems like this would be a usable alternative for you, since cost is usually the motivation for not using ELB.

Not as of now, no.

The answer to the question is slightly hidden, under an entirely different question in the ACM FAQ:

Q: Can I use the same certificate in more than one AWS Region?

It depends on whether you’re using Elastic Load Balancing or Amazon CloudFront. If you want to use a certificate with Elastic Load Balancing for the same site (the same fully qualified domain name, or FQDN, or set of FQDNs) in a different Region (when ACM is available in additional Regions), you will be required to request a new certificate for each Region in which you plan to use it. Certificates issued in the US East (Northern Virginia) Region and associated with an Amazon CloudFront distribution are distributed to the geographic locations configured for your distribution. (emphasis added)

https://aws.amazon.com/certificate-manager/faqs/

From that, we can safely conclude that the service can't be used for ELBs outside us-east-1, until such time as the service is deployed in the respective regions.

The AWS Global Infrastructure pages show the service only being available (as of this writing) in us-east-1.

The apparent discrepancy between in-region-only availability for ELB, compared with global availability with CloudFront, is explained by the fact that us-east-1 is the region that houses the infrastructure that actually controls the provisioning of all CloudFront edge locations.