> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ACM (certificates)

> ACM (certificates) APIs with Cloud Adapter.

This page describes how ACM (certificates) maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior.

## Supported environments

* Akamai
* Azure
* DigitalOcean
* Google Cloud
* OCI
* Private Kubernetes
* Scaleway

Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available.

## How the backends compare

Each row compares a capability of ACM (certificates) with its adaptation on each backend.
A dash means this profile does not state the capability for that backend.

### Cloud Adapter

| Capability | ACM (certificates) | Akamai, Azure, DigitalOcean, OCI, Private Kubernetes, and Scaleway · cert-manager Certificate | Azure · Key Vault | Google Cloud |
| - | - | - | - | - |
| Managed renewal · automatic renewal | Yes - managed renewal for issued certificates | Yes - cert-manager auto-renews ahead of expiry through its renew-before window | Partial - the generated policy sets no lifetime action, so renewal follows Key Vault's default for a self-signed certificate; check it before relying on renewal | Yes - Google auto-renews the managed certificate |
| Public trust · browser-trusted out of the box | Yes - public certificate authority | Yes - a Let's Encrypt ACME issuer produces a publicly-trusted certificate | No - a self-signed vault certificate is not publicly trusted | Yes - Google-managed publicly-trusted certificate |
| DNS validation · prove control with a CNAME | Yes - DNS CNAME domain validation | Yes - an ACME DNS-01 solver proves domain control by publishing a DNS record | No - no DNS-CNAME flow; issuance is governed by the certificate policy | Yes - a DNS authorization publishes the same kind of CNAME |
| Key confidentiality · is the private key kept out of reach | Yes - key withheld by default (opt-in export since 2025) | Partial - the private key is written to a Kubernetes Secret, readable in-cluster to anything with access, wider than the default | Partial - the vault certificate is issued exportable today, so its private key is always readable through the backing secret, wider than a default certificate, whose key is never retrievable | Yes - the managed key is never accessible and an imported key is write-only, so the service does not return private keys |
| Wildcard + subject alternative names · multi-domain coverage | Yes - up to one hundred subject alternative names | Yes - the certificate's common name and DNS names accept wildcards | Yes - the certificate policy holds the subject and its DNS alternative names, wildcards included | Yes - the managed certificate names the same domains, and authorizing a domain covers its wildcard |
| Attach model · how the certificate reaches the consumer | attached by reference to a load balancer, CDN, or gateway | its TLS Secret is referenced by the ingress that terminates TLS | referenced from the vault by the gateway or App Service that terminates TLS | bound through a certificate map on the target proxy (in practice it rides the load balancer) |
| Private-CA issuance · issue without reaching a public CA | No - public-certificate issuance in this mapping | Partial - without reaching a public ACME CA, only a self-signed or private-CA issuer works, which is privately trusted | Partial - a self-signed vault certificate is generated without reaching a public CA, but it is not publicly trusted | No - a Google-managed certificate is issued by Google's hosted CA over the network, not from a private CA |
| API coverage | full | high | partial | high |

## On Akamai, Azure, DigitalOcean, OCI, Private Kubernetes, and Scaleway

### cert-manager Certificate

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| DescribeCertificate | Describe | Supported | Common | returns the certificate's identity, realized at install time as the name of its TLS Secret |
| ListCertificates | Describe | Supported | Most usage | lists the installed certificates, known at install time |
| ImportCertificate | Issue | Supported | Most usage | a third-party certificate is brought in as a TLS Secret (or through a certificate-authority issuer), bringing its chain and key |
| RequestCertificate | Issue | Supported | Common | realized when the install is built as a cert-manager Certificate bound to a Let's Encrypt ACME cluster issuer with a DNS-01 solver: publicly trusted, DNS-validated, and auto-renewed; the closest analog to a DNS-validated public certificate |
| DeleteCertificate | Lifecycle | Supported | Most usage | realized at install time: the Certificate is removed, its readiness resource is folded away, and the consumer's reference is rewritten |
| UpdateCertificateOptions | Lifecycle | Out of scope | Full surface | certificate-option updates are outside this mapping; ACM has deprecated transparency-logging opt-out for public certificates |
| RenewCertificate | Renew | Supported | Most usage | cert-manager renews ahead of expiry through its renew-before window and the ACME issuer |
| ExportCertificate | Retrieve | Supported | Most usage | the export reads the private key from the Kubernetes Secret cert-manager writes, readable in-cluster to anything with access, wider than the certificate's default key-access policy |
| GetCertificate | Retrieve | Supported | Common | returns the certificate and its chain, never the private key |
| AddTagsToCertificate | Tags | Supported | Full surface | tags become metadata labels and annotations |
| RemoveTagsFromCertificate | Tags | Supported | Full surface | removes labels and annotations |
| DNS validation | Validate | Supported | Common | an ACME DNS-01 solver proves domain control by publishing a DNS record, domain validation through DNS |
| Email / HTTP validation | Validate | Out of scope | Most usage | there is no email or HTTP domain-approval flow that matches the origin's; a request for either validation method is rejected |

#### How it works

On AWS, ACM issues and renews the certificate, and a load balancer, CDN or API gateway uses it by ARN. By default, ACM does not expose the private key. On Kubernetes, Tensor9 creates a cert-manager `Certificate` for each `aws_acm_certificate` during installation, in the `traefik` namespace, and points the Ingress at its TLS `Secret`. cert-manager gets a publicly trusted certificate from Let's Encrypt and stores the certificate and key in that Secret.

The ACM operation names on this card describe infrastructure equivalents configured during installation. This mapping does not serve runtime AWS ACM API requests. Certificate issuance, retrieval, renewal, and deletion use the backend service and its access controls.

![On AWS, ACM validates and issues the certificate and the load balancer uses it by ARN. On Kubernetes, Tensor9 creates a cert-manager Certificate; cert-manager gets it from Let's Encrypt and stores it in a TLS Secret that the Ingress uses.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjQ0IiB2aWV3Qm94PSIwIDAgODM2IDI0NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEFDTSB2YWxpZGF0ZXMgYW5kIGlzc3VlcyB0aGUgY2VydGlmaWNhdGUgYW5kIHRoZSBsb2FkIGJhbGFuY2VyIHVzZXMgaXQgYnkgQVJOLiBPbiBLdWJlcm5ldGVzLCBUZW5zb3I5IGNyZWF0ZXMgYSBjZXJ0LW1hbmFnZXIgQ2VydGlmaWNhdGU7IGNlcnQtbWFuYWdlciBnZXRzIGl0IGZyb20gTGV0J3MgRW5jcnlwdCBhbmQgc3RvcmVzIGl0IGluIGEgVExTIFNlY3JldCB0aGF0IHRoZSBJbmdyZXNzIHVzZXMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImNtMSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PG1hcmtlciBpZD0iY20xZyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDgiIHdpZHRoPSIzOTAiIGhlaWdodD0iMTc2IiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzAiIHk9IjY2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSIxMDQiIHdpZHRoPSI5MCIgaGVpZ2h0PSI1OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI3MyIgeT0iMTMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+WW91ciBzdGFjazwvdGV4dD4KPHRleHQgeD0iNzMiIHk9IjE0NyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+cmVxdWVzdCBhIGNlcnQ8L3RleHQ+CjxsaW5lIHgxPSIxMTgiIHkxPSIxMzMiIHgyPSIxMzQiIHkyPSIxMzMiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjbTEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iMTM2IiB5PSIxMDQiIHdpZHRoPSIxMTgiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTk1IiB5PSIxMjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+QVdTIEFDTTwvdGV4dD4KPHRleHQgeD0iMTk1IiB5PSIxNDUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPnZhbGlkYXRlICsgaXNzdWU8L3RleHQ+CjxsaW5lIHgxPSIyNTQiIHkxPSIxMzMiIHgyPSIyNzAiIHkyPSIxMzMiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjbTEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iMjcyIiB5PSIxMDQiIHdpZHRoPSIxMjAiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMzI2LDExMCkgc2NhbGUoMC43MikiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojMzM0MTU1Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojMzM0MTU1Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PC9nPgo8dGV4dCB4PSIzMzIiIHk9IjE0MSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZTo5LjVweCI+QUxCIMK3IENsb3VkRnJvbnQ8L3RleHQ+Cjx0ZXh0IHg9IjMzMiIgeT0iMTU0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+dGVybWluYXRlcyBUTFM8L3RleHQ+Cjx0ZXh0IHg9IjIxMSIgeT0iMjAwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+ZGVmYXVsdCBBQ00ga2V5cyBzdGF5IGluIEFXUzwvdGV4dD4KPGxpbmUgeDE9IjQxOCIgeTE9IjU0IiB4Mj0iNDE4IiB5Mj0iMjE4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9InN0cm9rZTojY2JkNWUxIi8+CjxyZWN0IHg9IjQzMCIgeT0iNDgiIHdpZHRoPSIzOTAiIGhlaWdodD0iMTc2IiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDQ0IiB5PSI2NiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+T04gVEhFIFRBUkdFVCBDTE9VRCDCtyBLVUJFUk5FVEVTPC90ZXh0Pgo8cmVjdCB4PSI0NDIiIHk9IjEwNCIgd2lkdGg9Ijg0IiBoZWlnaHQ9IjU4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ4NCIgeT0iMTMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExcHgiPllvdXIgc3RhY2s8L3RleHQ+Cjx0ZXh0IHg9IjQ4NCIgeT0iMTQ2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPnVuY2hhbmdlZDwvdGV4dD4KPGxpbmUgeDE9IjUyNiIgeTE9IjEzMyIgeDI9IjU0MCIgeTI9IjEzMyIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2NtMSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI1NDIiIHk9Ijk5IiB3aWR0aD0iMTEwIiBoZWlnaHQ9IjY4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjU5NyIgeT0iMTIzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPlRlbnNvcjk8L3RleHQ+Cjx0ZXh0IHg9IjU5NyIgeT0iMTM4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5jcmVhdGVzIGE8L3RleHQ+Cjx0ZXh0IHg9IjU5NyIgeT0iMTUxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5DZXJ0aWZpY2F0ZTwvdGV4dD4KPGxpbmUgeDE9IjY1MiIgeTE9IjEzMyIgeDI9IjY2NiIgeTI9IjEzMyIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2NtMWcpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHJlY3QgeD0iNjY4IiB5PSIxMDQiIHdpZHRoPSIxNDAiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiM0ZjQ2ZTUiLz4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoNzMyLDExMCkgc2NhbGUoMC43MikiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojNGY0NmU1Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojNGY0NmU1Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PC9nPgo8dGV4dCB4PSI3MzgiIHk9IjE0MSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMC41cHg7ZmlsbDojNGY0NmU1Ij5JbmdyZXNzPC90ZXh0Pgo8dGV4dCB4PSI3MzgiIHk9IjE1NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPnRlcm1pbmF0ZXMgVExTPC90ZXh0Pgo8bGluZSB4MT0iNzM4IiB5MT0iMTg0IiB4Mj0iNzM4IiB5Mj0iMTY0IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNjbTFnKSIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9Ijc0NCIgeT0iMTc2IiB0ZXh0LWFuY2hvcj0ic3RhcnQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OHB4O2ZpbGw6IzA0Nzg1NyI+dGxzIFNlY3JldDwvdGV4dD4KPHJlY3QgeD0iNjY4IiB5PSIxODQiIHdpZHRoPSIxNDAiIGhlaWdodD0iMzgiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNzM4IiB5PSIyMDAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtd2VpZ2h0OjcwMCI+Y2VydC1tYW5hZ2VyPC90ZXh0Pgo8dGV4dCB4PSI3MzgiIHk9IjIxMyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjlweCI+aXNzdWVzIHZpYSBMZXQncyBFbmNyeXB0PC90ZXh0Pgo8L3N2Zz4=)

![On AWS, ACM validates and issues the certificate and the load balancer uses it by ARN. On Kubernetes, Tensor9 creates a cert-manager Certificate; cert-manager gets it from Let's Encrypt and stores it in a TLS Secret that the Ingress uses.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjQ0IiB2aWV3Qm94PSIwIDAgODM2IDI0NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEFDTSB2YWxpZGF0ZXMgYW5kIGlzc3VlcyB0aGUgY2VydGlmaWNhdGUgYW5kIHRoZSBsb2FkIGJhbGFuY2VyIHVzZXMgaXQgYnkgQVJOLiBPbiBLdWJlcm5ldGVzLCBUZW5zb3I5IGNyZWF0ZXMgYSBjZXJ0LW1hbmFnZXIgQ2VydGlmaWNhdGU7IGNlcnQtbWFuYWdlciBnZXRzIGl0IGZyb20gTGV0J3MgRW5jcnlwdCBhbmQgc3RvcmVzIGl0IGluIGEgVExTIFNlY3JldCB0aGF0IHRoZSBJbmdyZXNzIHVzZXMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImNtMSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PG1hcmtlciBpZD0iY20xZyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDgiIHdpZHRoPSIzOTAiIGhlaWdodD0iMTc2IiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzAiIHk9IjY2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSIxMDQiIHdpZHRoPSI5MCIgaGVpZ2h0PSI1OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI3MyIgeT0iMTMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+WW91ciBzdGFjazwvdGV4dD4KPHRleHQgeD0iNzMiIHk9IjE0NyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+cmVxdWVzdCBhIGNlcnQ8L3RleHQ+CjxsaW5lIHgxPSIxMTgiIHkxPSIxMzMiIHgyPSIxMzQiIHkyPSIxMzMiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjbTEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iMTM2IiB5PSIxMDQiIHdpZHRoPSIxMTgiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTk1IiB5PSIxMjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+QVdTIEFDTTwvdGV4dD4KPHRleHQgeD0iMTk1IiB5PSIxNDUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPnZhbGlkYXRlICsgaXNzdWU8L3RleHQ+CjxsaW5lIHgxPSIyNTQiIHkxPSIxMzMiIHgyPSIyNzAiIHkyPSIxMzMiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjbTEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iMjcyIiB5PSIxMDQiIHdpZHRoPSIxMjAiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMzI2LDExMCkgc2NhbGUoMC43MikiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojY2JkNWUxIi8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojY2JkNWUxIi8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PC9nPgo8dGV4dCB4PSIzMzIiIHk9IjE0MSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZTo5LjVweCI+QUxCIMK3IENsb3VkRnJvbnQ8L3RleHQ+Cjx0ZXh0IHg9IjMzMiIgeT0iMTU0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+dGVybWluYXRlcyBUTFM8L3RleHQ+Cjx0ZXh0IHg9IjIxMSIgeT0iMjAwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+ZGVmYXVsdCBBQ00ga2V5cyBzdGF5IGluIEFXUzwvdGV4dD4KPGxpbmUgeDE9IjQxOCIgeTE9IjU0IiB4Mj0iNDE4IiB5Mj0iMjE4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9InN0cm9rZTojNDc1NTY5Ii8+CjxyZWN0IHg9IjQzMCIgeT0iNDgiIHdpZHRoPSIzOTAiIGhlaWdodD0iMTc2IiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDQ0IiB5PSI2NiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+T04gVEhFIFRBUkdFVCBDTE9VRCDCtyBLVUJFUk5FVEVTPC90ZXh0Pgo8cmVjdCB4PSI0NDIiIHk9IjEwNCIgd2lkdGg9Ijg0IiBoZWlnaHQ9IjU4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ4NCIgeT0iMTMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExcHgiPllvdXIgc3RhY2s8L3RleHQ+Cjx0ZXh0IHg9IjQ4NCIgeT0iMTQ2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPnVuY2hhbmdlZDwvdGV4dD4KPGxpbmUgeDE9IjUyNiIgeTE9IjEzMyIgeDI9IjU0MCIgeTI9IjEzMyIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2NtMSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI1NDIiIHk9Ijk5IiB3aWR0aD0iMTEwIiBoZWlnaHQ9IjY4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjU5NyIgeT0iMTIzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPlRlbnNvcjk8L3RleHQ+Cjx0ZXh0IHg9IjU5NyIgeT0iMTM4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5jcmVhdGVzIGE8L3RleHQ+Cjx0ZXh0IHg9IjU5NyIgeT0iMTUxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5DZXJ0aWZpY2F0ZTwvdGV4dD4KPGxpbmUgeDE9IjY1MiIgeTE9IjEzMyIgeDI9IjY2NiIgeTI9IjEzMyIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2NtMWcpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHJlY3QgeD0iNjY4IiB5PSIxMDQiIHdpZHRoPSIxNDAiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiNhNWI0ZmMiLz4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoNzMyLDExMCkgc2NhbGUoMC43MikiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojYTViNGZjIi8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojYTViNGZjIi8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PC9nPgo8dGV4dCB4PSI3MzgiIHk9IjE0MSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMC41cHg7ZmlsbDojYTViNGZjIj5JbmdyZXNzPC90ZXh0Pgo8dGV4dCB4PSI3MzgiIHk9IjE1NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPnRlcm1pbmF0ZXMgVExTPC90ZXh0Pgo8bGluZSB4MT0iNzM4IiB5MT0iMTg0IiB4Mj0iNzM4IiB5Mj0iMTY0IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNjbTFnKSIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9Ijc0NCIgeT0iMTc2IiB0ZXh0LWFuY2hvcj0ic3RhcnQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OHB4O2ZpbGw6IzZlZTdiNyI+dGxzIFNlY3JldDwvdGV4dD4KPHJlY3QgeD0iNjY4IiB5PSIxODQiIHdpZHRoPSIxNDAiIGhlaWdodD0iMzgiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNzM4IiB5PSIyMDAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtd2VpZ2h0OjcwMCI+Y2VydC1tYW5hZ2VyPC90ZXh0Pgo8dGV4dCB4PSI3MzgiIHk9IjIxMyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjlweCI+aXNzdWVzIHZpYSBMZXQncyBFbmNyeXB0PC90ZXh0Pgo8L3N2Zz4=)

cert-manager stores the certificate in a TLS Secret that the Ingress uses for TLS.

#### The Certificate and its issuer

The `Certificate` (`cert-manager.io/v1`) Tensor9 creates sets three fields. `secretName` is your ACM resource name followed by `-tls`. `dnsNames` holds `domain_name` and `subject_alternative_names`, wildcards and variables included. `issuerRef` selects the `tensor9-letsencrypt-prod` `ClusterIssuer`. Validity, renewal timing and the key are left to cert-manager's defaults: a 90-day Let's Encrypt certificate with an RSA 2048 key.

Tensor9 also installs cert-manager and that issuer. Its `spec.acme` names the Let's Encrypt production server, the contact `email` you provide, and a `dns01` solver that proves domain control by writing a record in your Route 53 hosted zone. ACM's hosted ACME service, introduced in 2026, uses the same protocol.

![Tensor9 creates a Certificate that names the TLS Secret to write and, through issuerRef, uses a Let's Encrypt ClusterIssuer whose dns01 solver proves domain control through Route 53.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMzEyIiB2aWV3Qm94PSIwIDAgODM2IDMxMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUZW5zb3I5IGNyZWF0ZXMgYSBDZXJ0aWZpY2F0ZSB0aGF0IG5hbWVzIHRoZSBUTFMgU2VjcmV0IHRvIHdyaXRlIGFuZCwgdGhyb3VnaCBpc3N1ZXJSZWYsIHVzZXMgYSBMZXQncyBFbmNyeXB0IENsdXN0ZXJJc3N1ZXIgd2hvc2UgZG5zMDEgc29sdmVyIHByb3ZlcyBkb21haW4gY29udHJvbCB0aHJvdWdoIFJvdXRlIDUzLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJjbTJnIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiMwNDc4NTciLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI0IiB5PSI0MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzRmNDZlNSI+Q0VSVElGSUNBVEUgwrcgY2VydC1tYW5hZ2VyLmlvL3YxPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iNTIiIHdpZHRoPSIzODQiIGhlaWdodD0iMjEyIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojNGY0NmU1Ii8+Cjx0ZXh0IHg9IjQyIiB5PSI3NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NTtmb250LXNpemU6MTAuNXB4Ij5raW5kOiBDZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iNDIiIHk9Ijk0IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1O2ZvbnQtc2l6ZToxMC41cHgiPnNwZWM6PC90ZXh0Pgo8dGV4dCB4PSI1OCIgeT0iMTEyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1O2ZvbnQtc2l6ZToxMC41cHgiPnNlY3JldE5hbWU6IDx0c3BhbiBzdHlsZT0iZmlsbDojNGY0NmU1O2ZvbnQtd2VpZ2h0OjcwMCI+Jmx0O25hbWUmZ3Q7LXRsczwvdHNwYW4+PC90ZXh0Pgo8dGV4dCB4PSI1OCIgeT0iMTMwIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1O2ZvbnQtc2l6ZToxMC41cHgiPmlzc3VlclJlZjo8L3RleHQ+Cjx0ZXh0IHg9Ijc0IiB5PSIxNDciIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTU7Zm9udC1zaXplOjEwcHgiPm5hbWU6IHRlbnNvcjktbGV0c2VuY3J5cHQtcHJvZDwvdGV4dD4KPHRleHQgeD0iNzQiIHk9IjE2MyIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzA0Nzg1Nztmb250LXNpemU6MTBweCI+a2luZDogQ2x1c3Rlcklzc3VlcjwvdGV4dD4KPHRleHQgeD0iNTgiIHk9IjE4MSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NTtmb250LXNpemU6MTAuNXB4Ij5kbnNOYW1lczogW2V4YW1wbGUuY29tLCB3d3cu4oCmXTwvdGV4dD4KPHRleHQgeD0iNTgiIHk9IjIwNSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzY0NzQ4Yjtmb250LXNpemU6MTBweCI+IyBub3Qgc2V0LCBzbyBjZXJ0LW1hbmFnZXIgZGVmYXVsdHM6PC90ZXh0Pgo8dGV4dCB4PSI1OCIgeT0iMjIxIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojNjQ3NDhiO2ZvbnQtc2l6ZToxMHB4Ij4jIDkwLWRheSB2YWxpZGl0eSwgcmVuZXdhbDwvdGV4dD4KPHRleHQgeD0iNTgiIHk9IjIzNyIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzY0NzQ4Yjtmb250LXNpemU6MTBweCI+IyB0d28tdGhpcmRzIHRocm91Z2gsIFJTQSAyMDQ4IGtleTwvdGV4dD4KPHRleHQgeD0iNDUyIiB5PSI0MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+Q0xVU1RFUklTU1VFUiDCtyBjZXJ0LW1hbmFnZXIuaW8vdjE8L3RleHQ+CjxyZWN0IHg9IjQ1MiIgeT0iNTIiIHdpZHRoPSIzNjAiIGhlaWdodD0iMjEyIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQ3MCIgeT0iNzYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTU7Zm9udC1zaXplOjEwLjVweCI+a2luZDogQ2x1c3Rlcklzc3VlcjwvdGV4dD4KPHRleHQgeD0iNDcwIiB5PSI5NCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NTtmb250LXNpemU6MTAuNXB4Ij5tZXRhZGF0YTo8L3RleHQ+Cjx0ZXh0IHg9IjQ4NiIgeT0iMTExIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMDQ3ODU3O2ZvbnQtc2l6ZToxMHB4Ij5uYW1lOiB0ZW5zb3I5LWxldHNlbmNyeXB0LXByb2Q8L3RleHQ+Cjx0ZXh0IHg9IjQ3MCIgeT0iMTI5IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1O2ZvbnQtc2l6ZToxMC41cHgiPnNwZWM6PC90ZXh0Pgo8dGV4dCB4PSI0ODYiIHk9IjE0NyIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NTtmb250LXNpemU6MTAuNXB4Ij5hY21lOjwvdGV4dD4KPHRleHQgeD0iNTAyIiB5PSIxNjQiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTU7Zm9udC1zaXplOjEwcHgiPnNlcnZlcjogTGV0J3MgRW5jcnlwdCBwcm9kdWN0aW9uPC90ZXh0Pgo8dGV4dCB4PSI1MDIiIHk9IjE4MCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NTtmb250LXNpemU6MTBweCI+ZW1haWw6ICZsdDt5b3VyIGNvbnRhY3QgZW1haWwmZ3Q7PC90ZXh0Pgo8dGV4dCB4PSI1MDIiIHk9IjE5NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NTtmb250LXNpemU6MTAuNXB4Ij5zb2x2ZXJzOjwvdGV4dD4KPHRleHQgeD0iNTAyIiB5PSIyMTMiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMwNDc4NTc7Zm9udC13ZWlnaHQ6NzAwO2ZvbnQtc2l6ZToxMC41cHgiPi0gZG5zMDE6PC90ZXh0Pgo8dGV4dCB4PSI1MTgiIHk9IjIyOSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NTtmb250LXNpemU6MTBweCI+cm91dGU1MzogJiMxMjM7aG9zdGVkWm9uZUlEJiMxMjU7PC90ZXh0Pgo8dGV4dCB4PSI1MTgiIHk9IjI0NSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzY0NzQ4Yjtmb250LXNpemU6OS41cHgiPiMgcHJvdmVzIGRvbWFpbiBjb250cm9sPC90ZXh0Pgo8bGluZSB4MT0iNDA4IiB5MT0iMTU3IiB4Mj0iNDUwIiB5Mj0iMTA1IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNjbTJnKSIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQzMCIgeT0iMTQwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6OXB4O2ZvbnQtd2VpZ2h0OjcwMCI+aXNzdWVyUmVmPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMjc2IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjI4IiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNDE4IiB5PSIyOTQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMC41cHg7Zm9udC13ZWlnaHQ6NzAwIj5Ub2dldGhlcjogYSBETlMtdmFsaWRhdGVkLCBwdWJsaWNseSB0cnVzdGVkIGNlcnRpZmljYXRlIHRoYXQgcmVuZXdzIGF1dG9tYXRpY2FsbHk8L3RleHQ+Cjwvc3ZnPg==)

![Tensor9 creates a Certificate that names the TLS Secret to write and, through issuerRef, uses a Let's Encrypt ClusterIssuer whose dns01 solver proves domain control through Route 53.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMzEyIiB2aWV3Qm94PSIwIDAgODM2IDMxMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUZW5zb3I5IGNyZWF0ZXMgYSBDZXJ0aWZpY2F0ZSB0aGF0IG5hbWVzIHRoZSBUTFMgU2VjcmV0IHRvIHdyaXRlIGFuZCwgdGhyb3VnaCBpc3N1ZXJSZWYsIHVzZXMgYSBMZXQncyBFbmNyeXB0IENsdXN0ZXJJc3N1ZXIgd2hvc2UgZG5zMDEgc29sdmVyIHByb3ZlcyBkb21haW4gY29udHJvbCB0aHJvdWdoIFJvdXRlIDUzLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJjbTJnIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2ZWU3YjciLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI0IiB5PSI0MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2E1YjRmYyI+Q0VSVElGSUNBVEUgwrcgY2VydC1tYW5hZ2VyLmlvL3YxPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iNTIiIHdpZHRoPSIzODQiIGhlaWdodD0iMjEyIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojYTViNGZjIi8+Cjx0ZXh0IHg9IjQyIiB5PSI3NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMTtmb250LXNpemU6MTAuNXB4Ij5raW5kOiBDZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iNDIiIHk9Ijk0IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxO2ZvbnQtc2l6ZToxMC41cHgiPnNwZWM6PC90ZXh0Pgo8dGV4dCB4PSI1OCIgeT0iMTEyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxO2ZvbnQtc2l6ZToxMC41cHgiPnNlY3JldE5hbWU6IDx0c3BhbiBzdHlsZT0iZmlsbDojYTViNGZjO2ZvbnQtd2VpZ2h0OjcwMCI+Jmx0O25hbWUmZ3Q7LXRsczwvdHNwYW4+PC90ZXh0Pgo8dGV4dCB4PSI1OCIgeT0iMTMwIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxO2ZvbnQtc2l6ZToxMC41cHgiPmlzc3VlclJlZjo8L3RleHQ+Cjx0ZXh0IHg9Ijc0IiB5PSIxNDciIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTE7Zm9udC1zaXplOjEwcHgiPm5hbWU6IHRlbnNvcjktbGV0c2VuY3J5cHQtcHJvZDwvdGV4dD4KPHRleHQgeD0iNzQiIHk9IjE2MyIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6IzZlZTdiNztmb250LXNpemU6MTBweCI+a2luZDogQ2x1c3Rlcklzc3VlcjwvdGV4dD4KPHRleHQgeD0iNTgiIHk9IjE4MSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMTtmb250LXNpemU6MTAuNXB4Ij5kbnNOYW1lczogW2V4YW1wbGUuY29tLCB3d3cu4oCmXTwvdGV4dD4KPHRleHQgeD0iNTgiIHk9IjIwNSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6Izk0YTNiODtmb250LXNpemU6MTBweCI+IyBub3Qgc2V0LCBzbyBjZXJ0LW1hbmFnZXIgZGVmYXVsdHM6PC90ZXh0Pgo8dGV4dCB4PSI1OCIgeT0iMjIxIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojOTRhM2I4O2ZvbnQtc2l6ZToxMHB4Ij4jIDkwLWRheSB2YWxpZGl0eSwgcmVuZXdhbDwvdGV4dD4KPHRleHQgeD0iNTgiIHk9IjIzNyIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6Izk0YTNiODtmb250LXNpemU6MTBweCI+IyB0d28tdGhpcmRzIHRocm91Z2gsIFJTQSAyMDQ4IGtleTwvdGV4dD4KPHRleHQgeD0iNDUyIiB5PSI0MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+Q0xVU1RFUklTU1VFUiDCtyBjZXJ0LW1hbmFnZXIuaW8vdjE8L3RleHQ+CjxyZWN0IHg9IjQ1MiIgeT0iNTIiIHdpZHRoPSIzNjAiIGhlaWdodD0iMjEyIiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjQ3MCIgeT0iNzYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTE7Zm9udC1zaXplOjEwLjVweCI+a2luZDogQ2x1c3Rlcklzc3VlcjwvdGV4dD4KPHRleHQgeD0iNDcwIiB5PSI5NCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMTtmb250LXNpemU6MTAuNXB4Ij5tZXRhZGF0YTo8L3RleHQ+Cjx0ZXh0IHg9IjQ4NiIgeT0iMTExIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojNmVlN2I3O2ZvbnQtc2l6ZToxMHB4Ij5uYW1lOiB0ZW5zb3I5LWxldHNlbmNyeXB0LXByb2Q8L3RleHQ+Cjx0ZXh0IHg9IjQ3MCIgeT0iMTI5IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxO2ZvbnQtc2l6ZToxMC41cHgiPnNwZWM6PC90ZXh0Pgo8dGV4dCB4PSI0ODYiIHk9IjE0NyIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMTtmb250LXNpemU6MTAuNXB4Ij5hY21lOjwvdGV4dD4KPHRleHQgeD0iNTAyIiB5PSIxNjQiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTE7Zm9udC1zaXplOjEwcHgiPnNlcnZlcjogTGV0J3MgRW5jcnlwdCBwcm9kdWN0aW9uPC90ZXh0Pgo8dGV4dCB4PSI1MDIiIHk9IjE4MCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMTtmb250LXNpemU6MTBweCI+ZW1haWw6ICZsdDt5b3VyIGNvbnRhY3QgZW1haWwmZ3Q7PC90ZXh0Pgo8dGV4dCB4PSI1MDIiIHk9IjE5NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMTtmb250LXNpemU6MTAuNXB4Ij5zb2x2ZXJzOjwvdGV4dD4KPHRleHQgeD0iNTAyIiB5PSIyMTMiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiM2ZWU3Yjc7Zm9udC13ZWlnaHQ6NzAwO2ZvbnQtc2l6ZToxMC41cHgiPi0gZG5zMDE6PC90ZXh0Pgo8dGV4dCB4PSI1MTgiIHk9IjIyOSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMTtmb250LXNpemU6MTBweCI+cm91dGU1MzogJiMxMjM7aG9zdGVkWm9uZUlEJiMxMjU7PC90ZXh0Pgo8dGV4dCB4PSI1MTgiIHk9IjI0NSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6Izk0YTNiODtmb250LXNpemU6OS41cHgiPiMgcHJvdmVzIGRvbWFpbiBjb250cm9sPC90ZXh0Pgo8bGluZSB4MT0iNDA4IiB5MT0iMTU3IiB4Mj0iNDUwIiB5Mj0iMTA1IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNjbTJnKSIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjQzMCIgeT0iMTQwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6OXB4O2ZvbnQtd2VpZ2h0OjcwMCI+aXNzdWVyUmVmPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMjc2IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjI4IiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNDE4IiB5PSIyOTQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMC41cHg7Zm9udC13ZWlnaHQ6NzAwIj5Ub2dldGhlcjogYSBETlMtdmFsaWRhdGVkLCBwdWJsaWNseSB0cnVzdGVkIGNlcnRpZmljYXRlIHRoYXQgcmVuZXdzIGF1dG9tYXRpY2FsbHk8L3RleHQ+Cjwvc3ZnPg==)

The Certificate names the TLS Secret to write and uses the Let's Encrypt ClusterIssuer through issuerRef .

#### Issuance and DNS validation

cert-manager opens an ACME `Order` and publishes an `_acme-challenge` DNS record. Let's Encrypt checks that record and signs the certificate. cert-manager writes the certificate and private key to the TLS Secret, then sets the Certificate's `Ready` condition to true.

The `Ready` condition replaces ACM's separate `aws_acm_certificate_validation` wait, which Tensor9 removes along with the Route 53 validation records. Only DNS validation is supported: a certificate with `validation_method` `EMAIL` or `HTTP` stops the build with an error.

![cert-manager opens an ACME order, the dns01 solver publishes a DNS record, Let's Encrypt reads it to confirm you control the domain, and the certificate and key are stored in the TLS Secret as the Certificate becomes Ready.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjU2IiB2aWV3Qm94PSIwIDAgODM2IDI1NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJjZXJ0LW1hbmFnZXIgb3BlbnMgYW4gQUNNRSBvcmRlciwgdGhlIGRuczAxIHNvbHZlciBwdWJsaXNoZXMgYSBETlMgcmVjb3JkLCBMZXQncyBFbmNyeXB0IHJlYWRzIGl0IHRvIGNvbmZpcm0geW91IGNvbnRyb2wgdGhlIGRvbWFpbiwgYW5kIHRoZSBjZXJ0aWZpY2F0ZSBhbmQga2V5IGFyZSBzdG9yZWQgaW4gdGhlIFRMUyBTZWNyZXQgYXMgdGhlIENlcnRpZmljYXRlIGJlY29tZXMgUmVhZHkuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImNtMyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PG1hcmtlciBpZD0iY20zZyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNiIgeT0iMjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPkhPVyBBIGNlcnQtbWFuYWdlciBDRVJUSUZJQ0FURSBJUyBJU1NVRUQ8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIzNiIgd2lkdGg9IjE4MiIgaGVpZ2h0PSIxMTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPGNpcmNsZSBjeD0iNDIiIGN5PSI2MCIgcj0iMTAiIHN0eWxlPSJmaWxsOiNmMWY1Zjk7c3Ryb2tlOiNjYmQ1ZTEiLz48dGV4dCB4PSI0MiIgeT0iNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1Ij4xPC90ZXh0Pgo8dGV4dCB4PSIxMTUiIHk9IjY0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTFweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NSI+Q2VydGlmaWNhdGUgYXBwbGllZDwvdGV4dD4KPHRleHQgeD0iMTE1IiB5PSI4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+Y2VydC1tYW5hZ2VyIG9wZW5zPC90ZXh0Pgo8dGV4dCB4PSIxMTUiIHk9IjEwMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+YW4gQUNNRSBPcmRlcjwvdGV4dD4KPHJlY3QgeD0iNDYiIHk9IjExNiIgd2lkdGg9IjEzOCIgaGVpZ2h0PSIyMiIgcng9IjYiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTE1IiB5PSIxMzEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6OXB4O2ZpbGw6IzY0NzQ4YiI+a2luZDogT3JkZXI8L3RleHQ+CjxsaW5lIHgxPSIyMDYiIHkxPSI5NSIgeDI9IjIyNCIgeTI9Ijk1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY20zKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjIyNiIgeT0iMzYiIHdpZHRoPSIxODIiIGhlaWdodD0iMTE4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+CjxjaXJjbGUgY3g9IjI0NCIgY3k9IjYwIiByPSIxMCIgc3R5bGU9ImZpbGw6I2YxZjVmOTtzdHJva2U6I2NiZDVlMSIvPjx0ZXh0IHg9IjI0NCIgeT0iNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1Ij4yPC90ZXh0Pgo8dGV4dCB4PSIzMTciIHk9IjY0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTFweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzRmNDZlNSI+ZG5zMDEgc29sdmVyIHJ1bnM8L3RleHQ+Cjx0ZXh0IHg9IjMxNyIgeT0iODgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPnB1Ymxpc2hlcyBhIGNoYWxsZW5nZTwvdGV4dD4KPHRleHQgeD0iMzE3IiB5PSIxMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPnJlY29yZCBpbiB5b3VyIEROUyB6b25lPC90ZXh0Pgo8cmVjdCB4PSIyNDgiIHk9IjExNiIgd2lkdGg9IjEzOCIgaGVpZ2h0PSIyMiIgcng9IjYiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzE3IiB5PSIxMzEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6OC41cHg7ZmlsbDojNjQ3NDhiIj5fYWNtZS1jaGFsbGVuZ2UgIFRYVDwvdGV4dD4KPGxpbmUgeDE9IjQwOCIgeTE9Ijk1IiB4Mj0iNDI2IiB5Mj0iOTUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjbTMpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iNDI4IiB5PSIzNiIgd2lkdGg9IjE4MiIgaGVpZ2h0PSIxMTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPGNpcmNsZSBjeD0iNDQ2IiBjeT0iNjAiIHI9IjEwIiBzdHlsZT0iZmlsbDojZjFmNWY5O3N0cm9rZTojY2JkNWUxIi8+PHRleHQgeD0iNDQ2IiB5PSI2NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDExcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTUiPjM8L3RleHQ+Cjx0ZXh0IHg9IjUxOSIgeT0iNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1Ij50aGUgQUNNRSBDQSBjaGVja3MgaXQ8L3RleHQ+Cjx0ZXh0IHg9IjUxOSIgeT0iODgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPnJlYWRzIHRoZSByZWNvcmQgYW5kPC90ZXh0Pgo8dGV4dCB4PSI1MTkiIHk9IjEwMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+Y29uZmlybXMgZG9tYWluIGNvbnRyb2w8L3RleHQ+CjxyZWN0IHg9IjQ1MCIgeT0iMTE2IiB3aWR0aD0iMTM4IiBoZWlnaHQ9IjIyIiByeD0iNiIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI1MTkiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiM2NDc0OGIiPnB1YmxpYyBBQ01FIGF1dGhvcml0eTwvdGV4dD4KPGxpbmUgeDE9IjYxMCIgeTE9Ijk1IiB4Mj0iNjI4IiB5Mj0iOTUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjbTNnKSIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+CjxyZWN0IHg9IjYzMCIgeT0iMzYiIHdpZHRoPSIxODIiIGhlaWdodD0iMTE4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+CjxjaXJjbGUgY3g9IjY0OCIgY3k9IjYwIiByPSIxMCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPjx0ZXh0IHg9IjY0OCIgeT0iNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojMDQ3ODU3Ij40PC90ZXh0Pgo8dGV4dCB4PSI3MjEiIHk9IjY0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTFweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzA0Nzg1NyI+dGxzIFNlY3JldCDCtyBSZWFkeTwvdGV4dD4KPHRleHQgeD0iNzIxIiB5PSI4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjkuNXB4Ij5jZXJ0aWZpY2F0ZSBhbmQga2V5IHN0b3JlZDwvdGV4dD4KPHRleHQgeD0iNzIxIiB5PSIxMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZTo5LjVweCI+aW4gdGhlIHRscyBTZWNyZXQ8L3RleHQ+CjxyZWN0IHg9IjY1MiIgeT0iMTE2IiB3aWR0aD0iMTM4IiBoZWlnaHQ9IjIyIiByeD0iNiIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2E3ZjNkMCIvPgo8dGV4dCB4PSI3MjEiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiMwNDc4NTciPmNvbmRpdGlvbjogUmVhZHk9VHJ1ZTwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIxNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweCI+dGhlIENlcnRpZmljYXRlJ3MgPHRzcGFuIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMwNDc4NTciPlJlYWR5PC90c3Bhbj4gY29uZGl0aW9uIHJlcGxhY2VzIEFDTSdzIHNlcGFyYXRlIHZhbGlkYXRpb24gcmVzb3VyY2U8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxODgiIHdpZHRoPSI3ODgiIGhlaWdodD0iNTgiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiNmZmZiZWI7c3Ryb2tlOiNmZGU2OGEiLz4KPHRleHQgeD0iNDAiIHk9IjIwNiIgc3R5bGU9ImZvbnQ6NzAwIDEwcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNiNDUzMDkiPkVNQUlMIEFORCBIVFRQIFZBTElEQVRJT04gQVJFIE5PVCBTVVBQT1JURUQ8L3RleHQ+Cjx0ZXh0IHg9IjQwIiB5PSIyMjQiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweDtmaWxsOiNiNDUzMDkiPmNlcnQtbWFuYWdlciBwcm92ZXMgZG9tYWluIGNvbnRyb2wgd2l0aCBhbiBBQ01FIGRuczAxIHNvbHZlci4gQUNNIGVtYWlsIGFwcHJvdmFsIGFuZCBIVFRQIHZhbGlkYXRpb24gaGF2ZSBubzwvdGV4dD4KPHRleHQgeD0iNDAiIHk9IjIzOCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2I0NTMwOSI+ZXF1aXZhbGVudDogYSBjZXJ0aWZpY2F0ZSB0aGF0IGFza3MgZm9yIGVpdGhlciBzdG9wcyB0aGUgYnVpbGQgd2l0aCBhbiBlcnJvciBpbnN0ZWFkIG9mIGJlaW5nIHJlaXNzdWVkLjwvdGV4dD4KPC9zdmc+)

![cert-manager opens an ACME order, the dns01 solver publishes a DNS record, Let's Encrypt reads it to confirm you control the domain, and the certificate and key are stored in the TLS Secret as the Certificate becomes Ready.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjU2IiB2aWV3Qm94PSIwIDAgODM2IDI1NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJjZXJ0LW1hbmFnZXIgb3BlbnMgYW4gQUNNRSBvcmRlciwgdGhlIGRuczAxIHNvbHZlciBwdWJsaXNoZXMgYSBETlMgcmVjb3JkLCBMZXQncyBFbmNyeXB0IHJlYWRzIGl0IHRvIGNvbmZpcm0geW91IGNvbnRyb2wgdGhlIGRvbWFpbiwgYW5kIHRoZSBjZXJ0aWZpY2F0ZSBhbmQga2V5IGFyZSBzdG9yZWQgaW4gdGhlIFRMUyBTZWNyZXQgYXMgdGhlIENlcnRpZmljYXRlIGJlY29tZXMgUmVhZHkuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImNtMyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PG1hcmtlciBpZD0iY20zZyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNiIgeT0iMjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPkhPVyBBIGNlcnQtbWFuYWdlciBDRVJUSUZJQ0FURSBJUyBJU1NVRUQ8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIzNiIgd2lkdGg9IjE4MiIgaGVpZ2h0PSIxMTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPGNpcmNsZSBjeD0iNDIiIGN5PSI2MCIgcj0iMTAiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz48dGV4dCB4PSI0MiIgeT0iNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxIj4xPC90ZXh0Pgo8dGV4dCB4PSIxMTUiIHk9IjY0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTFweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMSI+Q2VydGlmaWNhdGUgYXBwbGllZDwvdGV4dD4KPHRleHQgeD0iMTE1IiB5PSI4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+Y2VydC1tYW5hZ2VyIG9wZW5zPC90ZXh0Pgo8dGV4dCB4PSIxMTUiIHk9IjEwMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+YW4gQUNNRSBPcmRlcjwvdGV4dD4KPHJlY3QgeD0iNDYiIHk9IjExNiIgd2lkdGg9IjEzOCIgaGVpZ2h0PSIyMiIgcng9IjYiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTE1IiB5PSIxMzEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6OXB4O2ZpbGw6Izk0YTNiOCI+a2luZDogT3JkZXI8L3RleHQ+CjxsaW5lIHgxPSIyMDYiIHkxPSI5NSIgeDI9IjIyNCIgeTI9Ijk1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY20zKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjIyNiIgeT0iMzYiIHdpZHRoPSIxODIiIGhlaWdodD0iMTE4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+CjxjaXJjbGUgY3g9IjI0NCIgY3k9IjYwIiByPSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPjx0ZXh0IHg9IjI0NCIgeT0iNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxIj4yPC90ZXh0Pgo8dGV4dCB4PSIzMTciIHk9IjY0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTFweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2E1YjRmYyI+ZG5zMDEgc29sdmVyIHJ1bnM8L3RleHQ+Cjx0ZXh0IHg9IjMxNyIgeT0iODgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPnB1Ymxpc2hlcyBhIGNoYWxsZW5nZTwvdGV4dD4KPHRleHQgeD0iMzE3IiB5PSIxMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPnJlY29yZCBpbiB5b3VyIEROUyB6b25lPC90ZXh0Pgo8cmVjdCB4PSIyNDgiIHk9IjExNiIgd2lkdGg9IjEzOCIgaGVpZ2h0PSIyMiIgcng9IjYiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzE3IiB5PSIxMzEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6OC41cHg7ZmlsbDojOTRhM2I4Ij5fYWNtZS1jaGFsbGVuZ2UgIFRYVDwvdGV4dD4KPGxpbmUgeDE9IjQwOCIgeTE9Ijk1IiB4Mj0iNDI2IiB5Mj0iOTUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjbTMpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iNDI4IiB5PSIzNiIgd2lkdGg9IjE4MiIgaGVpZ2h0PSIxMTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPGNpcmNsZSBjeD0iNDQ2IiBjeT0iNjAiIHI9IjEwIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+PHRleHQgeD0iNDQ2IiB5PSI2NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDExcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTEiPjM8L3RleHQ+Cjx0ZXh0IHg9IjUxOSIgeT0iNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxIj50aGUgQUNNRSBDQSBjaGVja3MgaXQ8L3RleHQ+Cjx0ZXh0IHg9IjUxOSIgeT0iODgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPnJlYWRzIHRoZSByZWNvcmQgYW5kPC90ZXh0Pgo8dGV4dCB4PSI1MTkiIHk9IjEwMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+Y29uZmlybXMgZG9tYWluIGNvbnRyb2w8L3RleHQ+CjxyZWN0IHg9IjQ1MCIgeT0iMTE2IiB3aWR0aD0iMTM4IiBoZWlnaHQ9IjIyIiByeD0iNiIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI1MTkiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiM5NGEzYjgiPnB1YmxpYyBBQ01FIGF1dGhvcml0eTwvdGV4dD4KPGxpbmUgeDE9IjYxMCIgeTE9Ijk1IiB4Mj0iNjI4IiB5Mj0iOTUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjbTNnKSIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+CjxyZWN0IHg9IjYzMCIgeT0iMzYiIHdpZHRoPSIxODIiIGhlaWdodD0iMTE4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+CjxjaXJjbGUgY3g9IjY0OCIgY3k9IjYwIiByPSIxMCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPjx0ZXh0IHg9IjY0OCIgeT0iNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojNmVlN2I3Ij40PC90ZXh0Pgo8dGV4dCB4PSI3MjEiIHk9IjY0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTFweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzZlZTdiNyI+dGxzIFNlY3JldCDCtyBSZWFkeTwvdGV4dD4KPHRleHQgeD0iNzIxIiB5PSI4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjkuNXB4Ij5jZXJ0aWZpY2F0ZSBhbmQga2V5IHN0b3JlZDwvdGV4dD4KPHRleHQgeD0iNzIxIiB5PSIxMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZTo5LjVweCI+aW4gdGhlIHRscyBTZWNyZXQ8L3RleHQ+CjxyZWN0IHg9IjY1MiIgeT0iMTE2IiB3aWR0aD0iMTM4IiBoZWlnaHQ9IjIyIiByeD0iNiIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI3MjEiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiM2ZWU3YjciPmNvbmRpdGlvbjogUmVhZHk9VHJ1ZTwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIxNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweCI+dGhlIENlcnRpZmljYXRlJ3MgPHRzcGFuIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiM2ZWU3YjciPlJlYWR5PC90c3Bhbj4gY29uZGl0aW9uIHJlcGxhY2VzIEFDTSdzIHNlcGFyYXRlIHZhbGlkYXRpb24gcmVzb3VyY2U8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxODgiIHdpZHRoPSI3ODgiIGhlaWdodD0iNTgiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiM0MjIwMDY7c3Ryb2tlOiM5MjQwMGUiLz4KPHRleHQgeD0iNDAiIHk9IjIwNiIgc3R5bGU9ImZvbnQ6NzAwIDEwcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNmYmJmMjQiPkVNQUlMIEFORCBIVFRQIFZBTElEQVRJT04gQVJFIE5PVCBTVVBQT1JURUQ8L3RleHQ+Cjx0ZXh0IHg9IjQwIiB5PSIyMjQiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweDtmaWxsOiNmYmJmMjQiPmNlcnQtbWFuYWdlciBwcm92ZXMgZG9tYWluIGNvbnRyb2wgd2l0aCBhbiBBQ01FIGRuczAxIHNvbHZlci4gQUNNIGVtYWlsIGFwcHJvdmFsIGFuZCBIVFRQIHZhbGlkYXRpb24gaGF2ZSBubzwvdGV4dD4KPHRleHQgeD0iNDAiIHk9IjIzOCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2ZiYmYyNCI+ZXF1aXZhbGVudDogYSBjZXJ0aWZpY2F0ZSB0aGF0IGFza3MgZm9yIGVpdGhlciBzdG9wcyB0aGUgYnVpbGQgd2l0aCBhbiBlcnJvciBpbnN0ZWFkIG9mIGJlaW5nIHJlaXNzdWVkLjwvdGV4dD4KPC9zdmc+)

Let's Encrypt checks a DNS record, then the certificate and key are stored in the TLS Secret and the Certificate becomes Ready .

#### Renewal

cert-manager renews the certificate before it expires. Because Tensor9 does not set `renewBefore`, cert-manager's default applies: renewal starts about two-thirds of the way through the certificate's life and repeats the DNS check and issuance.

Renewal writes the new certificate and key under the same `secretName`, so the Ingress reference stays valid. A certificate you import as a TLS Secret yourself is not renewed automatically.

![cert-manager renews about two-thirds of the way through the certificate's life. Renewal changes the contents of the TLS Secret, not its name, so the Ingress keeps working, the same way an ACM certificate keeps its ARN.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjI4IiB2aWV3Qm94PSIwIDAgODM2IDIyOCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJjZXJ0LW1hbmFnZXIgcmVuZXdzIGFib3V0IHR3by10aGlyZHMgb2YgdGhlIHdheSB0aHJvdWdoIHRoZSBjZXJ0aWZpY2F0ZSdzIGxpZmUuIFJlbmV3YWwgY2hhbmdlcyB0aGUgY29udGVudHMgb2YgdGhlIFRMUyBTZWNyZXQsIG5vdCBpdHMgbmFtZSwgc28gdGhlIEluZ3Jlc3Mga2VlcHMgd29ya2luZywgdGhlIHNhbWUgd2F5IGFuIEFDTSBjZXJ0aWZpY2F0ZSBrZWVwcyBpdHMgQVJOLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8dGV4dCB4PSIyNiIgeT0iMjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPmNlcnQtbWFuYWdlciBSRU5FV1MgQUhFQUQgT0YgRVhQSVJZIMK3IFRIRSB0bHMgU2VjcmV0IFNUQVlTIFBVVDwvdGV4dD4KPHRleHQgeD0iNjAiIHk9IjUyIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiM2NDc0OGIiPmlzc3VlZDwvdGV4dD4KPHRleHQgeD0iNzc2IiB5PSI1MiIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNjQ3NDhiIj5leHBpcmVzPC90ZXh0Pgo8cmVjdCB4PSI2MCIgeT0iNTgiIHdpZHRoPSI3MTYiIGhlaWdodD0iMjAiIHJ4PSI2IiBzdHlsZT0iZmlsbDojZjFmNWY5O3N0cm9rZTojY2JkNWUxIi8+CjxyZWN0IHg9IjUzNCIgeT0iNTgiIHdpZHRoPSIyNDIiIGhlaWdodD0iMjAiIHJ4PSI2IiBzdHlsZT0iZmlsbDojZmZmYmViO3N0cm9rZTojZmRlNjhhIi8+Cjx0ZXh0IHg9IjY1NSIgeT0iNzIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6OXB4O2ZpbGw6I2I0NTMwOSI+cmVuZXdCZWZvcmUgd2luZG93PC90ZXh0Pgo8bGluZSB4MT0iNTM0IiB5MT0iNDgiIHgyPSI1MzQiIHkyPSI5MiIgc3Ryb2tlLXdpZHRoPSIxLjgiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPgo8Y2lyY2xlIGN4PSI1MzQiIGN5PSI2OCIgcj0iNC41IiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjUzNCIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6OS41cHg7Zm9udC13ZWlnaHQ6NzAwIj5jZXJ0LW1hbmFnZXIgcmVuZXdzIGhlcmU8L3RleHQ+Cjx0ZXh0IHg9IjUzNCIgeT0iMTE5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+4omIIHR3by10aGlyZHMgdGhyb3VnaCB0aGUgZHVyYXRpb248L3RleHQ+CjxyZWN0IHg9IjYwIiB5PSIxNDAiIHdpZHRoPSIzNTAiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiM0ZjQ2ZTUiLz4KPHRleHQgeD0iMjM1IiB5PSIxNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojNGY0NmU1Ij50aGUgdGxzIFNlY3JldCBpcyByZXdyaXR0ZW4gaW4gcGxhY2U8L3RleHQ+Cjx0ZXh0IHg9IjIzNSIgeT0iMTgzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPmEgZnJlc2ggY2VydGlmaWNhdGUgYW5kIGtleSwgdW5kZXIgdGhlPC90ZXh0Pgo8dGV4dCB4PSIyMzUiIHk9IjE5NyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiMzMzQxNTUiPnNhbWUgc2VjcmV0TmFtZTwvdGV4dD4KPHJlY3QgeD0iNDI2IiB5PSIxNDAiIHdpZHRoPSIzNTAiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjAxIiB5PSIxNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojMDQ3ODU3Ij50aGUgSW5ncmVzcyByZWZlcmVuY2UgaXMgc3RhYmxlPC90ZXh0Pgo8dGV4dCB4PSI2MDEiIHk9IjE4MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEwcHgiPml0IHN0aWxsIHBvaW50cyBhdCB0aGUgc2FtZSBTZWNyZXQsPC90ZXh0Pgo8dGV4dCB4PSI2MDEiIHk9IjE5NyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEwcHgiPkluZ3Jlc3Mga2VlcHMgdGhlIFNlY3JldCByZWZlcmVuY2U8L3RleHQ+Cjwvc3ZnPg==)

![cert-manager renews about two-thirds of the way through the certificate's life. Renewal changes the contents of the TLS Secret, not its name, so the Ingress keeps working, the same way an ACM certificate keeps its ARN.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjI4IiB2aWV3Qm94PSIwIDAgODM2IDIyOCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJjZXJ0LW1hbmFnZXIgcmVuZXdzIGFib3V0IHR3by10aGlyZHMgb2YgdGhlIHdheSB0aHJvdWdoIHRoZSBjZXJ0aWZpY2F0ZSdzIGxpZmUuIFJlbmV3YWwgY2hhbmdlcyB0aGUgY29udGVudHMgb2YgdGhlIFRMUyBTZWNyZXQsIG5vdCBpdHMgbmFtZSwgc28gdGhlIEluZ3Jlc3Mga2VlcHMgd29ya2luZywgdGhlIHNhbWUgd2F5IGFuIEFDTSBjZXJ0aWZpY2F0ZSBrZWVwcyBpdHMgQVJOLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8dGV4dCB4PSIyNiIgeT0iMjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPmNlcnQtbWFuYWdlciBSRU5FV1MgQUhFQUQgT0YgRVhQSVJZIMK3IFRIRSB0bHMgU2VjcmV0IFNUQVlTIFBVVDwvdGV4dD4KPHRleHQgeD0iNjAiIHk9IjUyIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiM5NGEzYjgiPmlzc3VlZDwvdGV4dD4KPHRleHQgeD0iNzc2IiB5PSI1MiIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojOTRhM2I4Ij5leHBpcmVzPC90ZXh0Pgo8cmVjdCB4PSI2MCIgeT0iNTgiIHdpZHRoPSI3MTYiIGhlaWdodD0iMjAiIHJ4PSI2IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+CjxyZWN0IHg9IjUzNCIgeT0iNTgiIHdpZHRoPSIyNDIiIGhlaWdodD0iMjAiIHJ4PSI2IiBzdHlsZT0iZmlsbDojNDIyMDA2O3N0cm9rZTojOTI0MDBlIi8+Cjx0ZXh0IHg9IjY1NSIgeT0iNzIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6OXB4O2ZpbGw6I2ZiYmYyNCI+cmVuZXdCZWZvcmUgd2luZG93PC90ZXh0Pgo8bGluZSB4MT0iNTM0IiB5MT0iNDgiIHgyPSI1MzQiIHkyPSI5MiIgc3Ryb2tlLXdpZHRoPSIxLjgiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPgo8Y2lyY2xlIGN4PSI1MzQiIGN5PSI2OCIgcj0iNC41IiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjUzNCIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6OS41cHg7Zm9udC13ZWlnaHQ6NzAwIj5jZXJ0LW1hbmFnZXIgcmVuZXdzIGhlcmU8L3RleHQ+Cjx0ZXh0IHg9IjUzNCIgeT0iMTE5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+4omIIHR3by10aGlyZHMgdGhyb3VnaCB0aGUgZHVyYXRpb248L3RleHQ+CjxyZWN0IHg9IjYwIiB5PSIxNDAiIHdpZHRoPSIzNTAiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiNhNWI0ZmMiLz4KPHRleHQgeD0iMjM1IiB5PSIxNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYTViNGZjIj50aGUgdGxzIFNlY3JldCBpcyByZXdyaXR0ZW4gaW4gcGxhY2U8L3RleHQ+Cjx0ZXh0IHg9IjIzNSIgeT0iMTgzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPmEgZnJlc2ggY2VydGlmaWNhdGUgYW5kIGtleSwgdW5kZXIgdGhlPC90ZXh0Pgo8dGV4dCB4PSIyMzUiIHk9IjE5NyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNjYmQ1ZTEiPnNhbWUgc2VjcmV0TmFtZTwvdGV4dD4KPHJlY3QgeD0iNDI2IiB5PSIxNDAiIHdpZHRoPSIzNTAiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNjAxIiB5PSIxNjQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojNmVlN2I3Ij50aGUgSW5ncmVzcyByZWZlcmVuY2UgaXMgc3RhYmxlPC90ZXh0Pgo8dGV4dCB4PSI2MDEiIHk9IjE4MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEwcHgiPml0IHN0aWxsIHBvaW50cyBhdCB0aGUgc2FtZSBTZWNyZXQsPC90ZXh0Pgo8dGV4dCB4PSI2MDEiIHk9IjE5NyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEwcHgiPkluZ3Jlc3Mga2VlcHMgdGhlIFNlY3JldCByZWZlcmVuY2U8L3RleHQ+Cjwvc3ZnPg==)

Renewal changes the contents of the TLS Secret, not its name, just as an ACM certificate keeps its ARN.

#### Private key access

The Secret contains `tls.crt` and `tls.key`. Any principal permitted to read it can retrieve the private key. Default ACM public certificates do not expose that key.

Restrict Secret reads with Kubernetes role-based access control (RBAC), using `Role` and `RoleBinding` permissions for the relevant `ServiceAccount`. ACM's opt-in exportable public certificates, available since 2025, also allow key retrieval; this difference is relative to default, non-exportable ACM certificates.

![ACM returns a default certificate and chain but never the private key. On Kubernetes the key is stored in tls.key in the TLS Secret, so anyone who can read the Secret can read the key.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjYwIiB2aWV3Qm94PSIwIDAgODM2IDI2MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gcmV0dXJucyBhIGRlZmF1bHQgY2VydGlmaWNhdGUgYW5kIGNoYWluIGJ1dCBuZXZlciB0aGUgcHJpdmF0ZSBrZXkuIE9uIEt1YmVybmV0ZXMgdGhlIGtleSBpcyBzdG9yZWQgaW4gdGxzLmtleSBpbiB0aGUgVExTIFNlY3JldCwgc28gYW55b25lIHdobyBjYW4gcmVhZCB0aGUgU2VjcmV0IGNhbiByZWFkIHRoZSBrZXkuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+Cjx0ZXh0IHg9IjI2IiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzMzNDE1NSI+T04gQVdTIMK3IEEgREVGQVVMVCBDRVJUSUZJQ0FURSdTIEtFWSBJUyBORVZFUiBSRVRSSUVWQUJMRTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjM2IiB3aWR0aD0iMzYwIiBoZWlnaHQ9IjE1MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8cmVjdCB4PSI0MiIgeT0iNTgiIHdpZHRoPSIxNTAiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjExNyIgeT0iNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6OS41cHg7ZmlsbDojMzM0MTU1Ij5HZXRDZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iMTE3IiB5PSI5MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+d2hhdCB0aGUgY2FsbGVyIG1heSByZWFkPC90ZXh0Pgo8cmVjdCB4PSI0MiIgeT0iMTEwIiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjI2IiByeD0iNyIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2E3ZjNkMCIvPgo8dGV4dCB4PSIxMTciIHk9IjEyNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiMwNDc4NTciPmNlcnRpZmljYXRlICsgY2hhaW4g4pyTPC90ZXh0Pgo8cmVjdCB4PSI0MiIgeT0iMTQ0IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjI2IiByeD0iNyIgc3Ryb2tlLWRhc2hhcnJheT0iNCAzIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjExNyIgeT0iMTYxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzY0NzQ4YiI+cHJpdmF0ZSBrZXksIHdpdGhoZWxkPC90ZXh0Pgo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgzMDAsOTYpIHNjYWxlKDEuMjUpIj48cGF0aCBkPSJNNCA4IFY2IGE1IDUgMCAwIDEgMTAgMCBWOCIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJzdHJva2U6IzMzNDE1NSIvPjxyZWN0IHg9IjIiIHk9IjgiIHdpZHRoPSIxNCIgaGVpZ2h0PSIxMSIgcng9IjIuMiIgc3R5bGU9ImZpbGw6IzMzNDE1NSIvPjxjaXJjbGUgY3g9IjkiIGN5PSIxMi41IiByPSIxLjciIHN0eWxlPSJmaWxsOiNmZmZmZmYiLz48cmVjdCB4PSI4LjIiIHk9IjEzIiB3aWR0aD0iMS42IiBoZWlnaHQ9IjMuNiIgcng9IjAuOCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjwvZz4KPHRleHQgeD0iMzA5IiB5PSIxNTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5rZXkgc3RheXM8L3RleHQ+Cjx0ZXh0IHg9IjMwOSIgeT0iMTYyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+aW5zaWRlIEFDTTwvdGV4dD4KPHRleHQgeD0iNDUyIiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzRmNDZlNSI+T04gS1VCRVJORVRFUyDCtyBUSEUgS0VZIExJVkVTIElOIFRIRSB0bHMgU2VjcmV0PC90ZXh0Pgo8cmVjdCB4PSI0NTIiIHk9IjM2IiB3aWR0aD0iMzYwIiBoZWlnaHQ9IjE1MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6IzRmNDZlNSIvPgo8dGV4dCB4PSI0NzAiIHk9IjYwIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5raW5kOiBTZWNyZXQgwrcgdHlwZToga3ViZXJuZXRlcy5pby90bHM8L3RleHQ+CjxyZWN0IHg9IjQ3MCIgeT0iNzIiIHdpZHRoPSIzMjQiIGhlaWdodD0iMjYiIHJ4PSI3IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojYTdmM2QwIi8+Cjx0ZXh0IHg9IjQ4NCIgeT0iODkiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6OS41cHg7ZmlsbDojMDQ3ODU3Ij50bHMuY3J0OiAmbHQ7Y2VydGlmaWNhdGUgKyBjaGFpbiZndDs8L3RleHQ+CjxyZWN0IHg9IjQ3MCIgeT0iMTA0IiB3aWR0aD0iMzI0IiBoZWlnaHQ9IjI2IiByeD0iNyIgc3R5bGU9ImZpbGw6I2ZmZmJlYjtzdHJva2U6I2ZkZTY4YSIvPgo8dGV4dCB4PSI0ODQiIHk9IjEyMSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNiNDUzMDkiPnRscy5rZXk6ICZsdDt0aGUgcHJpdmF0ZSBrZXkmZ3Q7PC90ZXh0Pgo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSg0NzQsMTQwKSBzY2FsZSgwLjkpIj48cGF0aCBkPSJNNCA4IFY2IGE1IDUgMCAwIDEgOS42IC0xLjkiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0ic3Ryb2tlOiNiNDUzMDkiLz48cmVjdCB4PSIyIiB5PSI4IiB3aWR0aD0iMTQiIGhlaWdodD0iMTEiIHJ4PSIyLjIiIHN0eWxlPSJmaWxsOiNiNDUzMDkiLz48Y2lyY2xlIGN4PSI5IiBjeT0iMTIuNSIgcj0iMS43IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PHJlY3QgeD0iOC4yIiB5PSIxMyIgd2lkdGg9IjEuNiIgaGVpZ2h0PSIzLjYiIHJ4PSIwLjgiIHN0eWxlPSJmaWxsOiNmZmZmZmYiLz48L2c+Cjx0ZXh0IHg9IjQ5NCIgeT0iMTUzIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2I0NTMwOSI+YW55dGhpbmcgd2l0aCBSQkFDIHJlYWQgb24gdGhlIFNlY3JldCBjYW4gcmVhZCB0aGUga2V5PC90ZXh0Pgo8dGV4dCB4PSI0OTQiIHk9IjE3MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNjQ3NDhiIj5hIFJvbGUgLyBSb2xlQmluZGluZyBvdmVyIHRoZSBTZXJ2aWNlQWNjb3VudCBnb3Zlcm5zIHdobyB0aGF0IGlzPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTk2IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjU4IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojZmZmYmViO3N0cm9rZTojZmRlNjhhIi8+Cjx0ZXh0IHg9IjQwIiB5PSIyMTQiIHN0eWxlPSJmb250OjcwMCAxMHB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYjQ1MzA5Ij5Qcml2YXRlLWtleSBhY2Nlc3M8L3RleHQ+Cjx0ZXh0IHg9IjQwIiB5PSIyMzIiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweDtmaWxsOiNiNDUzMDkiPlNlY3JldCByZWFkIHBlcm1pc3Npb24gaW5jbHVkZXMgdGhlIHByaXZhdGUga2V5LjwvdGV4dD4KPHRleHQgeD0iNDAiIHk9IjI0NiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2I0NTMwOSI+RGVmYXVsdCBBQ00gcHVibGljIGNlcnRpZmljYXRlcyBhcmUgbm9uLWV4cG9ydGFibGUuPC90ZXh0Pgo8L3N2Zz4=)

![ACM returns a default certificate and chain but never the private key. On Kubernetes the key is stored in tls.key in the TLS Secret, so anyone who can read the Secret can read the key.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjYwIiB2aWV3Qm94PSIwIDAgODM2IDI2MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gcmV0dXJucyBhIGRlZmF1bHQgY2VydGlmaWNhdGUgYW5kIGNoYWluIGJ1dCBuZXZlciB0aGUgcHJpdmF0ZSBrZXkuIE9uIEt1YmVybmV0ZXMgdGhlIGtleSBpcyBzdG9yZWQgaW4gdGxzLmtleSBpbiB0aGUgVExTIFNlY3JldCwgc28gYW55b25lIHdobyBjYW4gcmVhZCB0aGUgU2VjcmV0IGNhbiByZWFkIHRoZSBrZXkuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+Cjx0ZXh0IHg9IjI2IiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2NiZDVlMSI+T04gQVdTIMK3IEEgREVGQVVMVCBDRVJUSUZJQ0FURSdTIEtFWSBJUyBORVZFUiBSRVRSSUVWQUJMRTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjM2IiB3aWR0aD0iMzYwIiBoZWlnaHQ9IjE1MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8cmVjdCB4PSI0MiIgeT0iNTgiIHdpZHRoPSIxNTAiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjExNyIgeT0iNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6OS41cHg7ZmlsbDojY2JkNWUxIj5HZXRDZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iMTE3IiB5PSI5MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+d2hhdCB0aGUgY2FsbGVyIG1heSByZWFkPC90ZXh0Pgo8cmVjdCB4PSI0MiIgeT0iMTEwIiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjI2IiByeD0iNyIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIxMTciIHk9IjEyNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiM2ZWU3YjciPmNlcnRpZmljYXRlICsgY2hhaW4g4pyTPC90ZXh0Pgo8cmVjdCB4PSI0MiIgeT0iMTQ0IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjI2IiByeD0iNyIgc3Ryb2tlLWRhc2hhcnJheT0iNCAzIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjExNyIgeT0iMTYxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6Izk0YTNiOCI+cHJpdmF0ZSBrZXksIHdpdGhoZWxkPC90ZXh0Pgo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgzMDAsOTYpIHNjYWxlKDEuMjUpIj48cGF0aCBkPSJNNCA4IFY2IGE1IDUgMCAwIDEgMTAgMCBWOCIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJzdHJva2U6I2NiZDVlMSIvPjxyZWN0IHg9IjIiIHk9IjgiIHdpZHRoPSIxNCIgaGVpZ2h0PSIxMSIgcng9IjIuMiIgc3R5bGU9ImZpbGw6I2NiZDVlMSIvPjxjaXJjbGUgY3g9IjkiIGN5PSIxMi41IiByPSIxLjciIHN0eWxlPSJmaWxsOiMxZTI5M2IiLz48cmVjdCB4PSI4LjIiIHk9IjEzIiB3aWR0aD0iMS42IiBoZWlnaHQ9IjMuNiIgcng9IjAuOCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjwvZz4KPHRleHQgeD0iMzA5IiB5PSIxNTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5rZXkgc3RheXM8L3RleHQ+Cjx0ZXh0IHg9IjMwOSIgeT0iMTYyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+aW5zaWRlIEFDTTwvdGV4dD4KPHRleHQgeD0iNDUyIiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2E1YjRmYyI+T04gS1VCRVJORVRFUyDCtyBUSEUgS0VZIExJVkVTIElOIFRIRSB0bHMgU2VjcmV0PC90ZXh0Pgo8cmVjdCB4PSI0NTIiIHk9IjM2IiB3aWR0aD0iMzYwIiBoZWlnaHQ9IjE1MCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6I2E1YjRmYyIvPgo8dGV4dCB4PSI0NzAiIHk9IjYwIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5raW5kOiBTZWNyZXQgwrcgdHlwZToga3ViZXJuZXRlcy5pby90bHM8L3RleHQ+CjxyZWN0IHg9IjQ3MCIgeT0iNzIiIHdpZHRoPSIzMjQiIGhlaWdodD0iMjYiIHJ4PSI3IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQ4NCIgeT0iODkiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6OS41cHg7ZmlsbDojNmVlN2I3Ij50bHMuY3J0OiAmbHQ7Y2VydGlmaWNhdGUgKyBjaGFpbiZndDs8L3RleHQ+CjxyZWN0IHg9IjQ3MCIgeT0iMTA0IiB3aWR0aD0iMzI0IiBoZWlnaHQ9IjI2IiByeD0iNyIgc3R5bGU9ImZpbGw6IzQyMjAwNjtzdHJva2U6IzkyNDAwZSIvPgo8dGV4dCB4PSI0ODQiIHk9IjEyMSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNmYmJmMjQiPnRscy5rZXk6ICZsdDt0aGUgcHJpdmF0ZSBrZXkmZ3Q7PC90ZXh0Pgo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSg0NzQsMTQwKSBzY2FsZSgwLjkpIj48cGF0aCBkPSJNNCA4IFY2IGE1IDUgMCAwIDEgOS42IC0xLjkiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0ic3Ryb2tlOiNmYmJmMjQiLz48cmVjdCB4PSIyIiB5PSI4IiB3aWR0aD0iMTQiIGhlaWdodD0iMTEiIHJ4PSIyLjIiIHN0eWxlPSJmaWxsOiNmYmJmMjQiLz48Y2lyY2xlIGN4PSI5IiBjeT0iMTIuNSIgcj0iMS43IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PHJlY3QgeD0iOC4yIiB5PSIxMyIgd2lkdGg9IjEuNiIgaGVpZ2h0PSIzLjYiIHJ4PSIwLjgiIHN0eWxlPSJmaWxsOiMxZTI5M2IiLz48L2c+Cjx0ZXh0IHg9IjQ5NCIgeT0iMTUzIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2ZiYmYyNCI+YW55dGhpbmcgd2l0aCBSQkFDIHJlYWQgb24gdGhlIFNlY3JldCBjYW4gcmVhZCB0aGUga2V5PC90ZXh0Pgo8dGV4dCB4PSI0OTQiIHk9IjE3MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojOTRhM2I4Ij5hIFJvbGUgLyBSb2xlQmluZGluZyBvdmVyIHRoZSBTZXJ2aWNlQWNjb3VudCBnb3Zlcm5zIHdobyB0aGF0IGlzPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTk2IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjU4IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojNDIyMDA2O3N0cm9rZTojOTI0MDBlIi8+Cjx0ZXh0IHg9IjQwIiB5PSIyMTQiIHN0eWxlPSJmb250OjcwMCAxMHB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojZmJiZjI0Ij5Qcml2YXRlLWtleSBhY2Nlc3M8L3RleHQ+Cjx0ZXh0IHg9IjQwIiB5PSIyMzIiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweDtmaWxsOiNmYmJmMjQiPlNlY3JldCByZWFkIHBlcm1pc3Npb24gaW5jbHVkZXMgdGhlIHByaXZhdGUga2V5LjwvdGV4dD4KPHRleHQgeD0iNDAiIHk9IjI0NiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2ZiYmYyNCI+RGVmYXVsdCBBQ00gcHVibGljIGNlcnRpZmljYXRlcyBhcmUgbm9uLWV4cG9ydGFibGUuPC90ZXh0Pgo8L3N2Zz4=)

Read access to the TLS Secret includes access to the private key in tls.key .

#### Clusters without internet access

Public issuance needs the cluster to reach Let's Encrypt and to publish DNS challenge records. The resulting certificate is trusted by any client that trusts Let's Encrypt.

For a cluster without that access, you configure a `selfSigned` or `ca` issuer. Its certificates are privately trusted: distribute the root to every client that must accept them. They do not provide public trust.

![A cluster that can reach Let's Encrypt gets a publicly trusted certificate. A cluster that cannot needs a selfSigned or ca issuer, whose certificates browsers do not trust until you distribute the root.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgODM2IDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBIGNsdXN0ZXIgdGhhdCBjYW4gcmVhY2ggTGV0J3MgRW5jcnlwdCBnZXRzIGEgcHVibGljbHkgdHJ1c3RlZCBjZXJ0aWZpY2F0ZS4gQSBjbHVzdGVyIHRoYXQgY2Fubm90IG5lZWRzIGEgc2VsZlNpZ25lZCBvciBjYSBpc3N1ZXIsIHdob3NlIGNlcnRpZmljYXRlcyBicm93c2VycyBkbyBub3QgdHJ1c3QgdW50aWwgeW91IGRpc3RyaWJ1dGUgdGhlIHJvb3QuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImNtNiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PG1hcmtlciBpZD0iY202ZyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PC9tYXJrZXI+PG1hcmtlciBpZD0iY202YSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojYjQ1MzA5Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNiIgeT0iMjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMzMzQxNTUiPlBVQkxJQyBUUlVTVCBORUVEUyBBIFJFQUNIQUJMRSBBQ01FIENFUlRJRklDQVRFIEFVVEhPUklUWTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9Ijg2IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjY0IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojNGY0NmU1Ii8+Cjx0ZXh0IHg9Ijk5IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTFweDtmaWxsOiM0ZjQ2ZTUiPnRoZSB0YXJnZXQgY2x1c3RlcjwvdGV4dD4KPHRleHQgeD0iOTkiIHk9IjEyOSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+Y2VydC1tYW5hZ2VyIGlzc3VlczwvdGV4dD4KPGxpbmUgeDE9IjE3NCIgeTE9IjEwNCIgeDI9IjI0NiIgeTI9IjcwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY202ZykiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIyMDYiIHk9IjgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6OC41cHg7Zm9udC13ZWlnaHQ6NzAwIj5yZWFjaGFibGU8L3RleHQ+CjxsaW5lIHgxPSIxNzQiIHkxPSIxMzIiIHgyPSIyNDYiIHkyPSIxNjYiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjbTZhKSIgc3R5bGU9InN0cm9rZTojYjQ1MzA5Ii8+Cjx0ZXh0IHg9IjIwNiIgeT0iMTU4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgOC41cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNiNDUzMDkiPmFpci1nYXBwZWQ8L3RleHQ+CjxyZWN0IHg9IjI1MCIgeT0iNDIiIHdpZHRoPSIyNDAiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMjY4IiB5PSI2NiIgc3R5bGU9ImZvbnQ6NzAwIDExcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiMwNDc4NTciPkFDTUUgQ2x1c3Rlcklzc3VlcjwvdGV4dD4KPHRleHQgeD0iMjY4IiB5PSI4NCIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjkuNXB4Ij5yZWFjaGVzIExldCdzIEVuY3J5cHQ8L3RleHQ+CjxsaW5lIHgxPSI0OTAiIHkxPSI3MSIgeDI9IjUxMiIgeTI9IjcxIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY202ZykiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPgo8cmVjdCB4PSI1MTYiIHk9IjQyIiB3aWR0aD0iMjk2IiBoZWlnaHQ9IjU4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojMDQ3ODU3Ii8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDUzNCw1Nikgc2NhbGUoMS4wNSkiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PC9nPgo8dGV4dCB4PSI1NzYiIHk9IjY2IiBzdHlsZT0iZm9udDo3MDAgMTFweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzA0Nzg1NyI+cHVibGljbHkgdHJ1c3RlZDwvdGV4dD4KPHRleHQgeD0iNTc2IiB5PSI4NCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+YSBicm93c2VyIGFjY2VwdHMgaXQgd2l0aCBubyBzZXR1cDwvdGV4dD4KPHJlY3QgeD0iMjUwIiB5PSIxMzYiIHdpZHRoPSIyNDAiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNmZmZiZWI7c3Ryb2tlOiNmNTllMGIiLz4KPHRleHQgeD0iMjY4IiB5PSIxNjAiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYjQ1MzA5Ij5zZWxmU2lnbmVkIC8gY2EgSXNzdWVyPC90ZXh0Pgo8dGV4dCB4PSIyNjgiIHk9IjE3OCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNiNDUzMDkiPndvcmtzIHdpdGhvdXQgaW50ZXJuZXQgYWNjZXNzPC90ZXh0Pgo8bGluZSB4MT0iNDkwIiB5MT0iMTY1IiB4Mj0iNTEyIiB5Mj0iMTY1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY202YSkiIHN0eWxlPSJzdHJva2U6I2I0NTMwOSIvPgo8cmVjdCB4PSI1MTYiIHk9IjEzNiIgd2lkdGg9IjI5NiIgaGVpZ2h0PSI1OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2Y1OWUwYiIvPgo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSg1MzQsMTUwKSBzY2FsZSgxLjA1KSI+PHBhdGggZD0iTTQgOCBWNiBhNSA1IDAgMCAxIDYuNSAtMy42IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIiBzdHlsZT0ic3Ryb2tlOiNiNDUzMDkiLz48cGF0aCBkPSJNMTQgOCBWNiBhNSA1IDAgMCAwIC0xLjQgLTMuNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0cm9rZS1saW5lY2FwPSJyb3VuZCIgc3R5bGU9InN0cm9rZTojYjQ1MzA5Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojYjQ1MzA5Ii8+PHBhdGggZD0iTTkgMTEgbC0xLjQgMyBoMi44IGwtMS40IDMiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHJva2UtbGluZWpvaW49InJvdW5kIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0eWxlPSJzdHJva2U6I2ZmZmZmZiIvPjwvZz4KPHRleHQgeD0iNTc2IiB5PSIxNjAiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYjQ1MzA5Ij5wcml2YXRlbHkgdHJ1c3RlZDwvdGV4dD4KPHRleHQgeD0iNTc2IiB5PSIxNzgiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6I2I0NTMwOSI+YSBicm93c2VyIHdhcm5zIHVudGlsIHRoZSByb290IGlzIGRpc3RyaWJ1dGVkPC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjIyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4Ij5jZXJ0LW1hbmFnZXIgaXNzdWVzIGFuZCByZW5ld3Mgb24gYm90aCBwYXRoczsgb25seSB0aGUgdHJ1c3QgZGlmZmVyczwvdGV4dD4KPC9zdmc+)

![A cluster that can reach Let's Encrypt gets a publicly trusted certificate. A cluster that cannot needs a selfSigned or ca issuer, whose certificates browsers do not trust until you distribute the root.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgODM2IDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBIGNsdXN0ZXIgdGhhdCBjYW4gcmVhY2ggTGV0J3MgRW5jcnlwdCBnZXRzIGEgcHVibGljbHkgdHJ1c3RlZCBjZXJ0aWZpY2F0ZS4gQSBjbHVzdGVyIHRoYXQgY2Fubm90IG5lZWRzIGEgc2VsZlNpZ25lZCBvciBjYSBpc3N1ZXIsIHdob3NlIGNlcnRpZmljYXRlcyBicm93c2VycyBkbyBub3QgdHJ1c3QgdW50aWwgeW91IGRpc3RyaWJ1dGUgdGhlIHJvb3QuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImNtNiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PG1hcmtlciBpZD0iY202ZyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PC9tYXJrZXI+PG1hcmtlciBpZD0iY202YSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojZmJiZjI0Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNiIgeT0iMjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiNjYmQ1ZTEiPlBVQkxJQyBUUlVTVCBORUVEUyBBIFJFQUNIQUJMRSBBQ01FIENFUlRJRklDQVRFIEFVVEhPUklUWTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9Ijg2IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjY0IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojYTViNGZjIi8+Cjx0ZXh0IHg9Ijk5IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTFweDtmaWxsOiNhNWI0ZmMiPnRoZSB0YXJnZXQgY2x1c3RlcjwvdGV4dD4KPHRleHQgeD0iOTkiIHk9IjEyOSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+Y2VydC1tYW5hZ2VyIGlzc3VlczwvdGV4dD4KPGxpbmUgeDE9IjE3NCIgeTE9IjEwNCIgeDI9IjI0NiIgeTI9IjcwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY202ZykiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSIyMDYiIHk9IjgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6OC41cHg7Zm9udC13ZWlnaHQ6NzAwIj5yZWFjaGFibGU8L3RleHQ+CjxsaW5lIHgxPSIxNzQiIHkxPSIxMzIiIHgyPSIyNDYiIHkyPSIxNjYiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjbTZhKSIgc3R5bGU9InN0cm9rZTojZmJiZjI0Ii8+Cjx0ZXh0IHg9IjIwNiIgeT0iMTU4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgOC41cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNmYmJmMjQiPmFpci1nYXBwZWQ8L3RleHQ+CjxyZWN0IHg9IjI1MCIgeT0iNDIiIHdpZHRoPSIyNDAiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMjY4IiB5PSI2NiIgc3R5bGU9ImZvbnQ6NzAwIDExcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiM2ZWU3YjciPkFDTUUgQ2x1c3Rlcklzc3VlcjwvdGV4dD4KPHRleHQgeD0iMjY4IiB5PSI4NCIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjkuNXB4Ij5yZWFjaGVzIExldCdzIEVuY3J5cHQ8L3RleHQ+CjxsaW5lIHgxPSI0OTAiIHkxPSI3MSIgeDI9IjUxMiIgeTI9IjcxIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY202ZykiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPgo8cmVjdCB4PSI1MTYiIHk9IjQyIiB3aWR0aD0iMjk2IiBoZWlnaHQ9IjU4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNmVlN2I3Ii8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDUzNCw1Nikgc2NhbGUoMS4wNSkiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PC9nPgo8dGV4dCB4PSI1NzYiIHk9IjY2IiBzdHlsZT0iZm9udDo3MDAgMTFweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzZlZTdiNyI+cHVibGljbHkgdHJ1c3RlZDwvdGV4dD4KPHRleHQgeD0iNTc2IiB5PSI4NCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+YSBicm93c2VyIGFjY2VwdHMgaXQgd2l0aCBubyBzZXR1cDwvdGV4dD4KPHJlY3QgeD0iMjUwIiB5PSIxMzYiIHdpZHRoPSIyNDAiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiM0MjIwMDY7c3Ryb2tlOiNmYmJmMjQiLz4KPHRleHQgeD0iMjY4IiB5PSIxNjAiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojZmJiZjI0Ij5zZWxmU2lnbmVkIC8gY2EgSXNzdWVyPC90ZXh0Pgo8dGV4dCB4PSIyNjgiIHk9IjE3OCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNmYmJmMjQiPndvcmtzIHdpdGhvdXQgaW50ZXJuZXQgYWNjZXNzPC90ZXh0Pgo8bGluZSB4MT0iNDkwIiB5MT0iMTY1IiB4Mj0iNTEyIiB5Mj0iMTY1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY202YSkiIHN0eWxlPSJzdHJva2U6I2ZiYmYyNCIvPgo8cmVjdCB4PSI1MTYiIHk9IjEzNiIgd2lkdGg9IjI5NiIgaGVpZ2h0PSI1OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6I2ZiYmYyNCIvPgo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSg1MzQsMTUwKSBzY2FsZSgxLjA1KSI+PHBhdGggZD0iTTQgOCBWNiBhNSA1IDAgMCAxIDYuNSAtMy42IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIiBzdHlsZT0ic3Ryb2tlOiNmYmJmMjQiLz48cGF0aCBkPSJNMTQgOCBWNiBhNSA1IDAgMCAwIC0xLjQgLTMuNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0cm9rZS1saW5lY2FwPSJyb3VuZCIgc3R5bGU9InN0cm9rZTojZmJiZjI0Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojZmJiZjI0Ii8+PHBhdGggZD0iTTkgMTEgbC0xLjQgMyBoMi44IGwtMS40IDMiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHJva2UtbGluZWpvaW49InJvdW5kIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0eWxlPSJzdHJva2U6IzFlMjkzYiIvPjwvZz4KPHRleHQgeD0iNTc2IiB5PSIxNjAiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojZmJiZjI0Ij5wcml2YXRlbHkgdHJ1c3RlZDwvdGV4dD4KPHRleHQgeD0iNTc2IiB5PSIxNzgiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6I2ZiYmYyNCI+YSBicm93c2VyIHdhcm5zIHVudGlsIHRoZSByb290IGlzIGRpc3RyaWJ1dGVkPC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjIyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4Ij5jZXJ0LW1hbmFnZXIgaXNzdWVzIGFuZCByZW5ld3Mgb24gYm90aCBwYXRoczsgb25seSB0aGUgdHJ1c3QgZGlmZmVyczwvdGV4dD4KPC9zdmc+)

Public trust needs a cluster that can reach Let's Encrypt; otherwise a selfSigned or ca issuer gives private trust only.

#### Limitations

Where cert-manager and ACM differ

* **The private key behaves differently: it can be read.** The TLS Secret holds both the certificate and the private key, and any identity that can read the Secret can read the key. Default ACM public certificates never expose their keys.
* **Public issuance needs internet and DNS access.** The cluster must reach Let's Encrypt and publish DNS challenge records. Without that, a self-signed or private CA issuer is needed, and every client must be set up to trust it.
* **Only Route 53 DNS validation is supported.** The Let's Encrypt issuer's DNS-01 solver writes to Route 53. A deployment whose DNS is Cloud DNS, Azure DNS, OCI DNS or Cloudflare fails with a DNS-provider-not-supported error.
* **Email and HTTP validation are not supported.** A certificate with `validation_method` `EMAIL` or `HTTP` stops the build with an error; it is not converted to an ACME HTTP-01 challenge.
* **Only RSA 2048 keys are supported.** A certificate whose `key_algorithm` is anything else, such as `EC_prime256v1` or `RSA_4096`, stops the build with an error.
* **Private CA and exportable ACM certificates are not supported.** A certificate that sets `certificate_authority_arn`, or `options.export = ENABLED`, stops the build with an error rather than being reissued by Let's Encrypt with a new key.
* **Other ACM options are not supported.** ACM hosted-ACME endpoint settings and `ManagedBy=CLOUDFRONT` are not reproduced. Public certificates are logged; ACM has deprecated the transparency-logging opt-out.
* **You must have a Kubernetes cluster in the deployment on Azure.** On Azure, the Certificate needs an AKS cluster created in the same stack or a cluster you bring. If the stack only uses an external cluster, the build reports a blocking issue.

#### Other considerations

* **You operate cert-manager.** Tensor9 installs cert-manager and the Let's Encrypt issuer; you provide the contact email and operate them with the cluster. Make sure the DNS solver can write to the hosted zone, and watch for failed Orders and Certificates that are not Ready.
* **Check renewal at the Ingress.** Renewal writes a new certificate to the same Secret. Confirm the Ingress reloads it and serves the renewed certificate. A TLS Secret you imported yourself needs replacements from you.
* **Moving from AWS.** Wait for each Certificate to become Ready before switching traffic. Existing ACM certificates are not copied; Let's Encrypt issues new ones. If you must keep a certificate and key you already hold, import them as a `kubernetes.io/tls` Secret.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### AWS ACM public certificates · Active public certificates

Feature: AWS ACM public certificates.

Estimated monthly service charges by Active public certificates. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: in-cluster; currency: USD.

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/68cf28a5b520611358f49aa64713a4bebf150aea39ec883b852d58f18f44b8de-light.svg)

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/a9d3e95c575253981f63f729566b450706e0e2948b37b15eb4f468942f51b0b2-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Active public certificates (certificates) | ACM Certificate | Target scenario | cert-manager Certificate | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | cert-manager Certificate (one staging copy) | 118.18 | 118.18 |
| 0 | 0.00 | cert-manager Certificate (two staging copies) | 236.36 | 236.36 |
| 10 | 0.00 | cert-manager Certificate (one staging copy) | 118.18 | 118.18 |
| 10 | 0.00 | cert-manager Certificate (two staging copies) | 236.36 | 236.36 |
| 100 | 0.00 | cert-manager Certificate (one staging copy) | 118.18 | 118.18 |
| 100 | 0.00 | cert-manager Certificate (two staging copies) | 236.36 | 236.36 |
| 1,000 | 0.00 | cert-manager Certificate (one staging copy) | 118.18 | 118.18 |
| 1,000 | 0.00 | cert-manager Certificate (two staging copies) | 236.36 | 236.36 |
| 10,000 | 0.00 | cert-manager Certificate (one staging copy) | 118.18 | 118.18 |
| 10,000 | 0.00 | cert-manager Certificate (two staging copies) | 236.36 | 236.36 |
| 100,000 | 0.00 | cert-manager Certificate (one staging copy) | 118.18 | 118.18 |
| 100,000 | 0.00 | cert-manager Certificate (two staging copies) | 236.36 | 236.36 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| cert-manager Certificate (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| cert-manager Certificate (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| cert-manager Certificate (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| cert-manager Certificate (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| cert-manager Certificate (one staging copy) | Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| cert-manager Certificate (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| cert-manager Certificate (one staging copy) | Target price guess · read | 0 | USD/read |
| cert-manager Certificate (one staging copy) | Target price guess · write | 0 | USD/write |
| cert-manager Certificate (one staging copy) | Target price guess · provider operation | 0 | USD/provider operation |
| cert-manager Certificate (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| cert-manager Certificate (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| cert-manager Certificate (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| cert-manager Certificate (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| cert-manager Certificate (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| cert-manager Certificate (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| cert-manager Certificate (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| cert-manager Certificate (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| cert-manager Certificate (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| cert-manager Certificate (one staging copy) | Target price guess · input token | 0 | USD/input token |
| cert-manager Certificate (one staging copy) | Target price guess · output token | 0 | USD/output token |
| cert-manager Certificate (one staging copy) | Target monthly base charge | 0 | USD/month |
| cert-manager Certificate (one staging copy) | Approximate target service minimum | 0 | USD/month |
| cert-manager Certificate (one staging copy) | Minimum primary CPU | 2 | vCPU |
| cert-manager Certificate (one staging copy) | Minimum primary RAM | 8 | GiB |
| cert-manager Certificate (one staging copy) | Minimum primary disk | 100 | GiB |
| cert-manager Certificate (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| cert-manager Certificate (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| cert-manager Certificate (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| cert-manager Certificate (one staging copy) | Planning peak / mean work | 2 | multiplier |
| cert-manager Certificate (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| cert-manager Certificate (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| cert-manager Certificate (one staging copy) | Planning disk utilization | 0.8 | fraction |
| cert-manager Certificate (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| cert-manager Certificate (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| cert-manager Certificate (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| cert-manager Certificate (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| cert-manager Certificate (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| cert-manager Certificate (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| cert-manager Certificate (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| cert-manager Certificate (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| cert-manager Certificate (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| cert-manager Certificate (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| cert-manager Certificate (two staging copies) | Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| cert-manager Certificate (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| cert-manager Certificate (two staging copies) | Target price guess · read | 0 | USD/read |
| cert-manager Certificate (two staging copies) | Target price guess · write | 0 | USD/write |
| cert-manager Certificate (two staging copies) | Target price guess · provider operation | 0 | USD/provider operation |
| cert-manager Certificate (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| cert-manager Certificate (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| cert-manager Certificate (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| cert-manager Certificate (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| cert-manager Certificate (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| cert-manager Certificate (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| cert-manager Certificate (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| cert-manager Certificate (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| cert-manager Certificate (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| cert-manager Certificate (two staging copies) | Target price guess · input token | 0 | USD/input token |
| cert-manager Certificate (two staging copies) | Target price guess · output token | 0 | USD/output token |
| cert-manager Certificate (two staging copies) | Target monthly base charge | 0 | USD/month |
| cert-manager Certificate (two staging copies) | Approximate target service minimum | 0 | USD/month |
| cert-manager Certificate (two staging copies) | Minimum primary CPU | 2 | vCPU |
| cert-manager Certificate (two staging copies) | Minimum primary RAM | 8 | GiB |
| cert-manager Certificate (two staging copies) | Minimum primary disk | 100 | GiB |
| cert-manager Certificate (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| cert-manager Certificate (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| cert-manager Certificate (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| cert-manager Certificate (two staging copies) | Planning peak / mean work | 2 | multiplier |
| cert-manager Certificate (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| cert-manager Certificate (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| cert-manager Certificate (two staging copies) | Planning disk utilization | 0.8 | fraction |
| cert-manager Certificate (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| cert-manager Certificate (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| cert-manager Certificate (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| cert-manager Certificate (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| cert-manager Certificate (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| cert-manager Certificate (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → in-cluster, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source price. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* cert-manager (Apache-2.0) with an ACME issuer has no vendor charge and Let's Encrypt issuance is free; the controller's pods use node capacity, and DNS-01 challenge records bill under the DNS provider.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* cert-manager license: [https://github.com/cert-manager/cert-manager/blob/master/LICENSE](https://github.com/cert-manager/cert-manager/blob/master/LICENSE)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-b9997b072d064101c5df2449030afac695fbe44e` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [cert-manager license](https://github.com/cert-manager/cert-manager/blob/master/LICENSE).

##### AWS ACM public certificates · Certificate issuances and renewals

Feature: AWS ACM public certificates.

Estimated monthly service charges by Certificate issuances and renewals. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: in-cluster; currency: USD.

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/b09d59ed811b609907e8657aad89320d7bda636768b59ec868f487a586122f54-light.svg)

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/bb9a4c0c367a61857d58ffeac985802e52e6de6cb41fa002fcaa194e2fc0125f-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Certificate issuances and renewals (issuances/month) | ACM Certificate | Target scenario | cert-manager Certificate | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | cert-manager Certificate (one staging copy) | 118.18 | 118.18 |
| 0 | 0.00 | cert-manager Certificate (two staging copies) | 236.36 | 236.36 |
| 10 | 0.00 | cert-manager Certificate (one staging copy) | 118.18 | 118.18 |
| 10 | 0.00 | cert-manager Certificate (two staging copies) | 236.36 | 236.36 |
| 100 | 0.00 | cert-manager Certificate (one staging copy) | 118.18 | 118.18 |
| 100 | 0.00 | cert-manager Certificate (two staging copies) | 236.36 | 236.36 |
| 1,000 | 0.00 | cert-manager Certificate (one staging copy) | 118.18 | 118.18 |
| 1,000 | 0.00 | cert-manager Certificate (two staging copies) | 236.36 | 236.36 |
| 10,000 | 0.00 | cert-manager Certificate (one staging copy) | 118.18 | 118.18 |
| 10,000 | 0.00 | cert-manager Certificate (two staging copies) | 236.36 | 236.36 |
| 100,000 | 0.00 | cert-manager Certificate (one staging copy) | 118.18 | 118.18 |
| 100,000 | 0.00 | cert-manager Certificate (two staging copies) | 236.36 | 236.36 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| cert-manager Certificate (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| cert-manager Certificate (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| cert-manager Certificate (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| cert-manager Certificate (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| cert-manager Certificate (one staging copy) | Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| cert-manager Certificate (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| cert-manager Certificate (one staging copy) | Target price guess · read | 0 | USD/read |
| cert-manager Certificate (one staging copy) | Target price guess · write | 0 | USD/write |
| cert-manager Certificate (one staging copy) | Target price guess · provider operation | 0 | USD/provider operation |
| cert-manager Certificate (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| cert-manager Certificate (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| cert-manager Certificate (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| cert-manager Certificate (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| cert-manager Certificate (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| cert-manager Certificate (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| cert-manager Certificate (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| cert-manager Certificate (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| cert-manager Certificate (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| cert-manager Certificate (one staging copy) | Target price guess · input token | 0 | USD/input token |
| cert-manager Certificate (one staging copy) | Target price guess · output token | 0 | USD/output token |
| cert-manager Certificate (one staging copy) | Target monthly base charge | 0 | USD/month |
| cert-manager Certificate (one staging copy) | Approximate target service minimum | 0 | USD/month |
| cert-manager Certificate (one staging copy) | Minimum primary CPU | 2 | vCPU |
| cert-manager Certificate (one staging copy) | Minimum primary RAM | 8 | GiB |
| cert-manager Certificate (one staging copy) | Minimum primary disk | 100 | GiB |
| cert-manager Certificate (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| cert-manager Certificate (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| cert-manager Certificate (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| cert-manager Certificate (one staging copy) | Planning peak / mean work | 2 | multiplier |
| cert-manager Certificate (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| cert-manager Certificate (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| cert-manager Certificate (one staging copy) | Planning disk utilization | 0.8 | fraction |
| cert-manager Certificate (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| cert-manager Certificate (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| cert-manager Certificate (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| cert-manager Certificate (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| cert-manager Certificate (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| cert-manager Certificate (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| cert-manager Certificate (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| cert-manager Certificate (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| cert-manager Certificate (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| cert-manager Certificate (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| cert-manager Certificate (two staging copies) | Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| cert-manager Certificate (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| cert-manager Certificate (two staging copies) | Target price guess · read | 0 | USD/read |
| cert-manager Certificate (two staging copies) | Target price guess · write | 0 | USD/write |
| cert-manager Certificate (two staging copies) | Target price guess · provider operation | 0 | USD/provider operation |
| cert-manager Certificate (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| cert-manager Certificate (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| cert-manager Certificate (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| cert-manager Certificate (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| cert-manager Certificate (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| cert-manager Certificate (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| cert-manager Certificate (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| cert-manager Certificate (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| cert-manager Certificate (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| cert-manager Certificate (two staging copies) | Target price guess · input token | 0 | USD/input token |
| cert-manager Certificate (two staging copies) | Target price guess · output token | 0 | USD/output token |
| cert-manager Certificate (two staging copies) | Target monthly base charge | 0 | USD/month |
| cert-manager Certificate (two staging copies) | Approximate target service minimum | 0 | USD/month |
| cert-manager Certificate (two staging copies) | Minimum primary CPU | 2 | vCPU |
| cert-manager Certificate (two staging copies) | Minimum primary RAM | 8 | GiB |
| cert-manager Certificate (two staging copies) | Minimum primary disk | 100 | GiB |
| cert-manager Certificate (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| cert-manager Certificate (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| cert-manager Certificate (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| cert-manager Certificate (two staging copies) | Planning peak / mean work | 2 | multiplier |
| cert-manager Certificate (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| cert-manager Certificate (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| cert-manager Certificate (two staging copies) | Planning disk utilization | 0.8 | fraction |
| cert-manager Certificate (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| cert-manager Certificate (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| cert-manager Certificate (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| cert-manager Certificate (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| cert-manager Certificate (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| cert-manager Certificate (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory remains at its authored default; issuance and renewal traffic varies independently. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → in-cluster, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source price. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* cert-manager (Apache-2.0) with an ACME issuer has no vendor charge and Let's Encrypt issuance is free; the controller's pods use node capacity, and DNS-01 challenge records bill under the DNS provider.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* cert-manager license: [https://github.com/cert-manager/cert-manager/blob/master/LICENSE](https://github.com/cert-manager/cert-manager/blob/master/LICENSE)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-b9997b072d064101c5df2449030afac695fbe44e` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [cert-manager license](https://github.com/cert-manager/cert-manager/blob/master/LICENSE).

**AWS ACM public certificates → cert-manager Certificate: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: in-cluster. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: Public non-exportable certificate inventory | 0.00 |
| Origin: Certificate issues and renewals | 0.00 |
| Origin: Certificate management reads | 0.00 |
| Target: Target retained physical data | 0.00 |
| Target: Additional broker replica storage | 0.00 |
| Target: Target native provider operations | 0.00 |
| Target: Execution or worker CPU | 0.00 |
| Target: Execution or worker RAM | 0.00 |
| Target: Selected billable network | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Durable staging CPU | 60.30 |
| Target: Durable staging RAM | 40.88 |
| Target: Durable staging disk | 17.00 |
| **Origin service subtotal** | **0.00** |
| **Target service subtotal** | **118.18** |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Origin list price · Certificate management reads | 0 | USD/requests |
| Provider operations per issuance | 20 | operations/issuance |
| Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| Issuance retry multiplier | 1.1 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target price guess · GiB-month | 0 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target price guess · network GiB | 0 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target list price · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| Public non-exportable certificate inventory | 100 | certificate-month |
| Certificate issues and renewals | 33 | issuances |
| Certificate management reads | 10,000 | requests |

* Translated reads: 10,000 operations.

* Translated writes: 33 operations.

* Translated resident physical data: under 0.01 GiB-month.

* Native provider operations: 726 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 0 vCPU-hour.

* Allocated execution RAM: 0 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 100 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.

* Public non-exportable source certificates have a zero authored source price. Exportable certificates and private-CA certificates require different models.

* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.

* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.

* cert-manager (Apache-2.0) with an ACME issuer has no vendor charge and Let's Encrypt issuance is free; the controller's pods use node capacity, and DNS-01 challenge records bill under the DNS provider.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-b9997b072d064101c5df2449030afac695fbe44e` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [cert-manager license](https://github.com/cert-manager/cert-manager/blob/master/LICENSE).

## On Azure

### Key Vault

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| DescribeCertificate | Describe | Supported | Common | returns the certificate's identity, realized at install time as a vault certificate reference |
| ListCertificates | Describe | Supported | Most usage | lists the installed certificates, known at install time |
| ImportCertificate | Issue | Out of scope | Common | an imported certificate's body, chain and private key are not kept; Tensor9 generates a new self-signed vault certificate for it instead. Import the certificate into the vault yourself if you need it |
| RequestCertificate | Issue | Partial | Common | realized when the install is built as a self-signed vault certificate (RSA 2048, exportable, 12 months) holding the subject and its alternative names; a self-signed vault certificate is not publicly trusted. A certificate that names a private CA, uses a key algorithm other than RSA\_2048, asks for email or HTTP validation, or sets options.export=ENABLED stops the build |
| DeleteCertificate | Lifecycle | Supported | Most usage | realized at install time: the vault certificate is removed and its consumer's reference is rewritten; the vault's own soft-delete retention holds it before it is purged |
| UpdateCertificateOptions | Lifecycle | Out of scope | Full surface | certificate-option updates are outside this mapping; ACM has deprecated transparency-logging opt-out for public certificates |
| RenewCertificate | Renew | Partial | Most usage | the generated certificate policy sets no lifetime action, so renewal follows Key Vault's default for a self-signed certificate; check that default, or add a lifetime action, before relying on renewal |
| ExportCertificate | Retrieve | Supported | Most usage | the export reads the private key from the backing vault secret; the generated certificate is exportable, so the key is retrievable, wider than the certificate's default key-access policy, whose key is never returned |
| GetCertificate | Retrieve | Supported | Common | returns the certificate and its chain, never the private key |
| AddTagsToCertificate | Tags | Supported | Full surface | tags become vault-resource tags |
| RemoveTagsFromCertificate | Tags | Supported | Full surface | removes tags |
| DNS validation | Validate | Out of scope | Common | Key Vault has no DNS-CNAME domain-validation flow; issuance is governed by the certificate policy instead, so DNS validation is rejected |
| Email / HTTP validation | Validate | Out of scope | Most usage | there is no email or HTTP domain-approval flow; a request for either validation method is rejected |

#### How it works

On AWS, your stack requests a certificate from ACM and attaches it by ARN to a load balancer, CDN or API gateway, which handles TLS. By default, ACM does not expose the private key. On Azure, Tensor9 creates one `azurerm_key_vault_certificate` for each `aws_acm_certificate`, in the deployment's shared Key Vault, and points the service that handles TLS at it. The certificate is self-signed, so clients must be set up to trust it.

The ACM operation names on this card describe infrastructure equivalents configured during installation. This mapping does not serve runtime AWS ACM API requests. Certificate issuance, retrieval, renewal, and deletion use the backend service and its access controls.

![On AWS, your stack requests an ACM certificate and attaches it by ARN to the load balancer or gateway. On Azure, Tensor9 creates a Key Vault certificate during installation and points the same TLS endpoint at it.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEwIiB2aWV3Qm94PSIwIDAgODM2IDIxMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIHlvdXIgc3RhY2sgcmVxdWVzdHMgYW4gQUNNIGNlcnRpZmljYXRlIGFuZCBhdHRhY2hlcyBpdCBieSBBUk4gdG8gdGhlIGxvYWQgYmFsYW5jZXIgb3IgZ2F0ZXdheS4gT24gQXp1cmUsIFRlbnNvcjkgY3JlYXRlcyBhIEtleSBWYXVsdCBjZXJ0aWZpY2F0ZSBkdXJpbmcgaW5zdGFsbGF0aW9uIGFuZCBwb2ludHMgdGhlIHNhbWUgVExTIGVuZHBvaW50IGF0IGl0LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJhY21rdjEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImFjbWt2MWciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzA0Nzg1NyIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQwIiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjE1MCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIyOCIgeT0iNzgiIHdpZHRoPSIxMDQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iODAiIHk9IjEwNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHgiPllvdXIgc3RhY2s8L3RleHQ+Cjx0ZXh0IHg9IjgwIiB5PSIxMjEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweCI+cmVxdWVzdCBhIGNlcnQ8L3RleHQ+CjxsaW5lIHgxPSIxMzIiIHkxPSIxMDgiIHgyPSIxNTAiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNhY21rdjEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iMTUwIiB5PSI3OCIgd2lkdGg9IjExOCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIyMDkiIHk9IjEwMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5BV1MgQUNNPC90ZXh0Pgo8dGV4dCB4PSIyMDkiIHk9IjExNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+dmFsaWRhdGUgZG9tYWluPC90ZXh0Pgo8dGV4dCB4PSIyMDkiIHk9IjEyOSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+aXNzdWUgY2VydGlmaWNhdGU8L3RleHQ+CjxsaW5lIHgxPSIyNjgiIHkxPSIxMDgiIHgyPSIyODYiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNhY21rdjEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iMjg2IiB5PSI3OCIgd2lkdGg9IjEwNCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgzMDAsOTApIHNjYWxlKDAuNzIpIj48cGF0aCBkPSJNNCA4IFY2IGE1IDUgMCAwIDEgMTAgMCBWOCIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJzdHJva2U6IzMzNDE1NSIvPjxyZWN0IHg9IjIiIHk9IjgiIHdpZHRoPSIxNCIgaGVpZ2h0PSIxMSIgcng9IjIuMiIgc3R5bGU9ImZpbGw6IzMzNDE1NSIvPjxjaXJjbGUgY3g9IjkiIGN5PSIxMi41IiByPSIxLjciIHN0eWxlPSJmaWxsOiNmZmZmZmYiLz48cmVjdCB4PSI4LjIiIHk9IjEzIiB3aWR0aD0iMS42IiBoZWlnaHQ9IjMuNiIgcng9IjAuOCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjwvZz4KPHRleHQgeD0iMzUyIiB5PSIxMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6OS41cHgiPkFMQiDCtyBnYXRld2F5PC90ZXh0Pgo8dGV4dCB4PSIzMzgiIHk9IjEyMyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+dGVybWluYXRlcyBUTFM8L3RleHQ+Cjx0ZXh0IHg9IjIwOCIgeT0iMTcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+YXR0YWNoZWQgYnkgQVJOLCBkZWZhdWx0IEFDTSBrZXlzIHN0YXkgaW4gQVdTPC90ZXh0Pgo8bGluZSB4MT0iNDE4IiB5MT0iNDYiIHgyPSI0MTgiIHkyPSIxODQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0ic3Ryb2tlOiNjYmQ1ZTEiLz4KPHJlY3QgeD0iNDM2IiB5PSI0MCIgd2lkdGg9IjM4NCIgaGVpZ2h0PSIxNTAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NTAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PTiBBWlVSRTwvdGV4dD4KPHJlY3QgeD0iNDQ4IiB5PSI3OCIgd2lkdGg9Ijk2IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ5NiIgeT0iMTA1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+WW91ciBzdGFjazwvdGV4dD4KPHRleHQgeD0iNDk2IiB5PSIxMjEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+dW5jaGFuZ2VkPC90ZXh0Pgo8bGluZSB4MT0iNTQ0IiB5MT0iMTA4IiB4Mj0iNTYwIiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjYWNta3YxKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjU2MCIgeT0iNzQiIHdpZHRoPSIxMjIiIGhlaWdodD0iNjgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjIxIiB5PSI5OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij5UZW5zb3I5PC90ZXh0Pgo8dGV4dCB4PSI2MjEiIHk9IjExNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+Y3JlYXRlcyB0aGUgY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjYyMSIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5kdXJpbmcgaW5zdGFsbGF0aW9uPC90ZXh0Pgo8bGluZSB4MT0iNjgyIiB5MT0iMTA4IiB4Mj0iNjk4IiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjYWNta3YxZykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI2OTgiIHk9Ijc4IiB3aWR0aD0iMTA2IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9Ijc1MSIgeT0iMTAzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEwcHgiPkF6dXJlIEtleSBWYXVsdDwvdGV4dD4KPHRleHQgeD0iNzUxIiB5PSIxMjEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPnNlbGYtc2lnbmVkIGNlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSI2MjgiIHk9IjE3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojMDQ3ODU3Ij50aGUgbG9hZCBiYWxhbmNlciBoYW5kbGVzIGFwcGxpY2F0aW9uIFRMUzwvdGV4dD4KPC9zdmc+)

![On AWS, your stack requests an ACM certificate and attaches it by ARN to the load balancer or gateway. On Azure, Tensor9 creates a Key Vault certificate during installation and points the same TLS endpoint at it.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEwIiB2aWV3Qm94PSIwIDAgODM2IDIxMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIHlvdXIgc3RhY2sgcmVxdWVzdHMgYW4gQUNNIGNlcnRpZmljYXRlIGFuZCBhdHRhY2hlcyBpdCBieSBBUk4gdG8gdGhlIGxvYWQgYmFsYW5jZXIgb3IgZ2F0ZXdheS4gT24gQXp1cmUsIFRlbnNvcjkgY3JlYXRlcyBhIEtleSBWYXVsdCBjZXJ0aWZpY2F0ZSBkdXJpbmcgaW5zdGFsbGF0aW9uIGFuZCBwb2ludHMgdGhlIHNhbWUgVExTIGVuZHBvaW50IGF0IGl0LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJhY21rdjEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImFjbWt2MWciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzZlZTdiNyIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQwIiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjE1MCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIyOCIgeT0iNzgiIHdpZHRoPSIxMDQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iODAiIHk9IjEwNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHgiPllvdXIgc3RhY2s8L3RleHQ+Cjx0ZXh0IHg9IjgwIiB5PSIxMjEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweCI+cmVxdWVzdCBhIGNlcnQ8L3RleHQ+CjxsaW5lIHgxPSIxMzIiIHkxPSIxMDgiIHgyPSIxNTAiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNhY21rdjEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iMTUwIiB5PSI3OCIgd2lkdGg9IjExOCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIyMDkiIHk9IjEwMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5BV1MgQUNNPC90ZXh0Pgo8dGV4dCB4PSIyMDkiIHk9IjExNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+dmFsaWRhdGUgZG9tYWluPC90ZXh0Pgo8dGV4dCB4PSIyMDkiIHk9IjEyOSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+aXNzdWUgY2VydGlmaWNhdGU8L3RleHQ+CjxsaW5lIHgxPSIyNjgiIHkxPSIxMDgiIHgyPSIyODYiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNhY21rdjEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iMjg2IiB5PSI3OCIgd2lkdGg9IjEwNCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgzMDAsOTApIHNjYWxlKDAuNzIpIj48cGF0aCBkPSJNNCA4IFY2IGE1IDUgMCAwIDEgMTAgMCBWOCIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJzdHJva2U6I2NiZDVlMSIvPjxyZWN0IHg9IjIiIHk9IjgiIHdpZHRoPSIxNCIgaGVpZ2h0PSIxMSIgcng9IjIuMiIgc3R5bGU9ImZpbGw6I2NiZDVlMSIvPjxjaXJjbGUgY3g9IjkiIGN5PSIxMi41IiByPSIxLjciIHN0eWxlPSJmaWxsOiMxZTI5M2IiLz48cmVjdCB4PSI4LjIiIHk9IjEzIiB3aWR0aD0iMS42IiBoZWlnaHQ9IjMuNiIgcng9IjAuOCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjwvZz4KPHRleHQgeD0iMzUyIiB5PSIxMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6OS41cHgiPkFMQiDCtyBnYXRld2F5PC90ZXh0Pgo8dGV4dCB4PSIzMzgiIHk9IjEyMyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+dGVybWluYXRlcyBUTFM8L3RleHQ+Cjx0ZXh0IHg9IjIwOCIgeT0iMTcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+YXR0YWNoZWQgYnkgQVJOLCBkZWZhdWx0IEFDTSBrZXlzIHN0YXkgaW4gQVdTPC90ZXh0Pgo8bGluZSB4MT0iNDE4IiB5MT0iNDYiIHgyPSI0MTgiIHkyPSIxODQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0ic3Ryb2tlOiM0NzU1NjkiLz4KPHJlY3QgeD0iNDM2IiB5PSI0MCIgd2lkdGg9IjM4NCIgaGVpZ2h0PSIxNTAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NTAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PTiBBWlVSRTwvdGV4dD4KPHJlY3QgeD0iNDQ4IiB5PSI3OCIgd2lkdGg9Ijk2IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ5NiIgeT0iMTA1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+WW91ciBzdGFjazwvdGV4dD4KPHRleHQgeD0iNDk2IiB5PSIxMjEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+dW5jaGFuZ2VkPC90ZXh0Pgo8bGluZSB4MT0iNTQ0IiB5MT0iMTA4IiB4Mj0iNTYwIiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjYWNta3YxKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjU2MCIgeT0iNzQiIHdpZHRoPSIxMjIiIGhlaWdodD0iNjgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNjIxIiB5PSI5OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij5UZW5zb3I5PC90ZXh0Pgo8dGV4dCB4PSI2MjEiIHk9IjExNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+Y3JlYXRlcyB0aGUgY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjYyMSIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5kdXJpbmcgaW5zdGFsbGF0aW9uPC90ZXh0Pgo8bGluZSB4MT0iNjgyIiB5MT0iMTA4IiB4Mj0iNjk4IiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjYWNta3YxZykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI2OTgiIHk9Ijc4IiB3aWR0aD0iMTA2IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9Ijc1MSIgeT0iMTAzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEwcHgiPkF6dXJlIEtleSBWYXVsdDwvdGV4dD4KPHRleHQgeD0iNzUxIiB5PSIxMjEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPnNlbGYtc2lnbmVkIGNlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSI2MjgiIHk9IjE3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNmVlN2I3Ij50aGUgbG9hZCBiYWxhbmNlciBoYW5kbGVzIGFwcGxpY2F0aW9uIFRMUzwvdGV4dD4KPC9zdmc+)

During installation, Tensor9 creates a Key Vault certificate and points your TLS endpoint at it.

#### What the certificate contains

The certificate's `certificate_policy` holds your request. `domain_name` becomes the subject (`CN=example.com`), and `domain_name` plus `subject_alternative_names` become the DNS names, wildcards included. The key is always RSA 2048 and exportable, and the certificate is valid for 12 months.

The policy sets `issuer_parameters.name = Self`, so Key Vault generates the key and self-signs the certificate. Wait for its certificate operation to complete; no separate DNS approval is required. Tensor9 always creates a new certificate and key. It does not copy an existing certificate body or key; if you must keep one, import it into Key Vault yourself with its chain and passphrase.

![Each ACM certificate becomes one Key Vault certificate. Its policy holds the subject, the alternative names and an exportable RSA 2048 key, is valid for 12 months, and names Self as the issuer.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjcyIiB2aWV3Qm94PSIwIDAgODM2IDI3MiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJFYWNoIEFDTSBjZXJ0aWZpY2F0ZSBiZWNvbWVzIG9uZSBLZXkgVmF1bHQgY2VydGlmaWNhdGUuIEl0cyBwb2xpY3kgaG9sZHMgdGhlIHN1YmplY3QsIHRoZSBhbHRlcm5hdGl2ZSBuYW1lcyBhbmQgYW4gZXhwb3J0YWJsZSBSU0EgMjA0OCBrZXksIGlzIHZhbGlkIGZvciAxMiBtb250aHMsIGFuZCBuYW1lcyBTZWxmIGFzIHRoZSBpc3N1ZXIuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImFjbWt2MiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMzMzQxNTUiPk9ORSBLRVkgVkFVTFQgQ0VSVElGSUNBVEUgUEVSIEFDTSBDRVJUSUZJQ0FURTwvdGV4dD4KPHRleHQgeD0iMjQiIHk9IjUyIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiM2NDc0OGIiPllPVVIgQUNNIFJFUVVFU1Q8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI1OCIgd2lkdGg9IjIwMCIgaGVpZ2h0PSI0MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjM2IiB5PSI3NiIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiM2NDc0OGIiPmRvbWFpbl9uYW1lPC90ZXh0Pgo8dGV4dCB4PSIzNiIgeT0iOTAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPmV4YW1wbGUuY29tPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTA0IiB3aWR0aD0iMjAwIiBoZWlnaHQ9IjQwIiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzYiIHk9IjEyMiIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiM2NDc0OGIiPnN1YmplY3RfYWx0ZXJuYXRpdmVfbmFtZXM8L3RleHQ+Cjx0ZXh0IHg9IjM2IiB5PSIxMzYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPnd3dyDCtyBhcGk8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxNTAiIHdpZHRoPSIyMDAiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNiIgeT0iMTY4IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4O2ZpbGw6IzY0NzQ4YiI+a2V5X2FsZ29yaXRobTwvdGV4dD4KPHRleHQgeD0iMzYiIHk9IjE4MiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+UlNBXzIwNDg8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxOTYiIHdpZHRoPSIyMDAiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNiIgeT0iMjE0IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4O2ZpbGw6IzY0NzQ4YiI+dmFsaWRhdGlvbl9tZXRob2Q8L3RleHQ+Cjx0ZXh0IHg9IjM2IiB5PSIyMjgiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPkROUzwvdGV4dD4KPGxpbmUgeDE9IjIzMCIgeTE9IjE0NyIgeDI9IjI5MiIgeTI9IjE0NyIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2FjbWt2MikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSIyNjEiIHk9IjEzOSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4cHgiPmJlY29tZXM8L3RleHQ+CjxyZWN0IHg9IjMwMCIgeT0iNDAiIHdpZHRoPSI1MTIiIGhlaWdodD0iMjE0IiByeD0iMTMiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNGY0NmU1Ii8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDMxNiw1MCkiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojNGY0NmU1Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojNGY0NmU1Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PC9nPgo8dGV4dCB4PSIzNDAiIHk9IjY0IiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHg7ZmlsbDojNGY0NmU1Ij5henVyZXJtX2tleV92YXVsdF9jZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iNzk2IiB5PSI2NCIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPmluIHRoZSBzaGFyZWQgdmF1bHQ8L3RleHQ+CjxyZWN0IHg9IjMxNiIgeT0iNzgiIHdpZHRoPSI0ODAiIGhlaWdodD0iMTYwIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojZWVmMmZmIi8+Cjx0ZXh0IHg9IjMzMCIgeT0iOTciIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHg7ZmlsbDojNGY0NmU1Ij5jZXJ0aWZpY2F0ZV9wb2xpY3k8L3RleHQ+CjxyZWN0IHg9IjMzMCIgeT0iMTA0IiB3aWR0aD0iNDUyIiBoZWlnaHQ9IjI0IiByeD0iNiIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojZWVmMmZmO3N0cm9rZTojZWVmMmZmIi8+Cjx0ZXh0IHg9IjM0MiIgeT0iMTIwIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHg7ZmlsbDojNGY0NmU1Ij5pc3N1ZXJfcGFyYW1ldGVycy5uYW1lID0gU2VsZjwvdGV4dD4KPHRleHQgeD0iNzcwIiB5PSIxMjAiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OHB4O2ZpbGw6IzRmNDZlNSI+c2VsZi1zaWduZWQ8L3RleHQ+CjxyZWN0IHg9IjMzMCIgeT0iMTMyIiB3aWR0aD0iNDUyIiBoZWlnaHQ9IjI0IiByeD0iNiIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojZjhmYWZjIi8+Cjx0ZXh0IHg9IjM0MiIgeT0iMTQ4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij54NTA5X2NlcnRpZmljYXRlX3Byb3BlcnRpZXMuc3ViamVjdCA9IENOPWV4YW1wbGUuY29tPC90ZXh0Pgo8cmVjdCB4PSIzMzAiIHk9IjE2MCIgd2lkdGg9IjQ1MiIgaGVpZ2h0PSIyNCIgcng9IjYiIHN0cm9rZS13aWR0aD0iMSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2Y4ZmFmYyIvPgo8dGV4dCB4PSIzNDIiIHk9IjE3NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+4oCmc3ViamVjdF9hbHRlcm5hdGl2ZV9uYW1lcy5kbnNfbmFtZXMgPSBbd3d3LCBhcGldPC90ZXh0Pgo8cmVjdCB4PSIzMzAiIHk9IjE4OCIgd2lkdGg9IjQ1MiIgaGVpZ2h0PSIyNCIgcng9IjYiIHN0cm9rZS13aWR0aD0iMSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2Y4ZmFmYyIvPgo8dGV4dCB4PSIzNDIiIHk9IjIwNCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+a2V5X3Byb3BlcnRpZXMgPSAmIzEyMzsgUlNBLCAyMDQ4LCBleHBvcnRhYmxlID0gdHJ1ZSAmIzEyNTs8L3RleHQ+CjxyZWN0IHg9IjMzMCIgeT0iMjE2IiB3aWR0aD0iNDUyIiBoZWlnaHQ9IjI0IiByeD0iNiIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojZjhmYWZjIi8+Cjx0ZXh0IHg9IjM0MiIgeT0iMjMyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij52YWxpZGl0eV9pbl9tb250aHMgPSAxMjwvdGV4dD4KPC9zdmc+)

![Each ACM certificate becomes one Key Vault certificate. Its policy holds the subject, the alternative names and an exportable RSA 2048 key, is valid for 12 months, and names Self as the issuer.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjcyIiB2aWV3Qm94PSIwIDAgODM2IDI3MiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJFYWNoIEFDTSBjZXJ0aWZpY2F0ZSBiZWNvbWVzIG9uZSBLZXkgVmF1bHQgY2VydGlmaWNhdGUuIEl0cyBwb2xpY3kgaG9sZHMgdGhlIHN1YmplY3QsIHRoZSBhbHRlcm5hdGl2ZSBuYW1lcyBhbmQgYW4gZXhwb3J0YWJsZSBSU0EgMjA0OCBrZXksIGlzIHZhbGlkIGZvciAxMiBtb250aHMsIGFuZCBuYW1lcyBTZWxmIGFzIHRoZSBpc3N1ZXIuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImFjbWt2MiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiNjYmQ1ZTEiPk9ORSBLRVkgVkFVTFQgQ0VSVElGSUNBVEUgUEVSIEFDTSBDRVJUSUZJQ0FURTwvdGV4dD4KPHRleHQgeD0iMjQiIHk9IjUyIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiM5NGEzYjgiPllPVVIgQUNNIFJFUVVFU1Q8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI1OCIgd2lkdGg9IjIwMCIgaGVpZ2h0PSI0MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjM2IiB5PSI3NiIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiM5NGEzYjgiPmRvbWFpbl9uYW1lPC90ZXh0Pgo8dGV4dCB4PSIzNiIgeT0iOTAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPmV4YW1wbGUuY29tPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTA0IiB3aWR0aD0iMjAwIiBoZWlnaHQ9IjQwIiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzYiIHk9IjEyMiIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiM5NGEzYjgiPnN1YmplY3RfYWx0ZXJuYXRpdmVfbmFtZXM8L3RleHQ+Cjx0ZXh0IHg9IjM2IiB5PSIxMzYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPnd3dyDCtyBhcGk8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxNTAiIHdpZHRoPSIyMDAiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNiIgeT0iMTY4IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4O2ZpbGw6Izk0YTNiOCI+a2V5X2FsZ29yaXRobTwvdGV4dD4KPHRleHQgeD0iMzYiIHk9IjE4MiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+UlNBXzIwNDg8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxOTYiIHdpZHRoPSIyMDAiIGhlaWdodD0iNDAiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNiIgeT0iMjE0IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4O2ZpbGw6Izk0YTNiOCI+dmFsaWRhdGlvbl9tZXRob2Q8L3RleHQ+Cjx0ZXh0IHg9IjM2IiB5PSIyMjgiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPkROUzwvdGV4dD4KPGxpbmUgeDE9IjIzMCIgeTE9IjE0NyIgeDI9IjI5MiIgeTI9IjE0NyIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2FjbWt2MikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSIyNjEiIHk9IjEzOSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4cHgiPmJlY29tZXM8L3RleHQ+CjxyZWN0IHg9IjMwMCIgeT0iNDAiIHdpZHRoPSI1MTIiIGhlaWdodD0iMjE0IiByeD0iMTMiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojYTViNGZjIi8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDMxNiw1MCkiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojYTViNGZjIi8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojYTViNGZjIi8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PC9nPgo8dGV4dCB4PSIzNDAiIHk9IjY0IiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHg7ZmlsbDojYTViNGZjIj5henVyZXJtX2tleV92YXVsdF9jZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iNzk2IiB5PSI2NCIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPmluIHRoZSBzaGFyZWQgdmF1bHQ8L3RleHQ+CjxyZWN0IHg9IjMxNiIgeT0iNzgiIHdpZHRoPSI0ODAiIGhlaWdodD0iMTYwIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojMWUxYjRiIi8+Cjx0ZXh0IHg9IjMzMCIgeT0iOTciIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHg7ZmlsbDojYTViNGZjIj5jZXJ0aWZpY2F0ZV9wb2xpY3k8L3RleHQ+CjxyZWN0IHg9IjMzMCIgeT0iMTA0IiB3aWR0aD0iNDUyIiBoZWlnaHQ9IjI0IiByeD0iNiIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojMWUxYjRiO3N0cm9rZTojMWUxYjRiIi8+Cjx0ZXh0IHg9IjM0MiIgeT0iMTIwIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHg7ZmlsbDojYTViNGZjIj5pc3N1ZXJfcGFyYW1ldGVycy5uYW1lID0gU2VsZjwvdGV4dD4KPHRleHQgeD0iNzcwIiB5PSIxMjAiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OHB4O2ZpbGw6I2E1YjRmYyI+c2VsZi1zaWduZWQ8L3RleHQ+CjxyZWN0IHg9IjMzMCIgeT0iMTMyIiB3aWR0aD0iNDUyIiBoZWlnaHQ9IjI0IiByeD0iNiIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojMGYxNzJhIi8+Cjx0ZXh0IHg9IjM0MiIgeT0iMTQ4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj54NTA5X2NlcnRpZmljYXRlX3Byb3BlcnRpZXMuc3ViamVjdCA9IENOPWV4YW1wbGUuY29tPC90ZXh0Pgo8cmVjdCB4PSIzMzAiIHk9IjE2MCIgd2lkdGg9IjQ1MiIgaGVpZ2h0PSIyNCIgcng9IjYiIHN0cm9rZS13aWR0aD0iMSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzBmMTcyYSIvPgo8dGV4dCB4PSIzNDIiIHk9IjE3NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+4oCmc3ViamVjdF9hbHRlcm5hdGl2ZV9uYW1lcy5kbnNfbmFtZXMgPSBbd3d3LCBhcGldPC90ZXh0Pgo8cmVjdCB4PSIzMzAiIHk9IjE4OCIgd2lkdGg9IjQ1MiIgaGVpZ2h0PSIyNCIgcng9IjYiIHN0cm9rZS13aWR0aD0iMSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzBmMTcyYSIvPgo8dGV4dCB4PSIzNDIiIHk9IjIwNCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+a2V5X3Byb3BlcnRpZXMgPSAmIzEyMzsgUlNBLCAyMDQ4LCBleHBvcnRhYmxlID0gdHJ1ZSAmIzEyNTs8L3RleHQ+CjxyZWN0IHg9IjMzMCIgeT0iMjE2IiB3aWR0aD0iNDUyIiBoZWlnaHQ9IjI0IiByeD0iNiIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojMGYxNzJhIi8+Cjx0ZXh0IHg9IjM0MiIgeT0iMjMyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj52YWxpZGl0eV9pbl9tb250aHMgPSAxMjwvdGV4dD4KPC9zdmc+)

Each ACM certificate becomes one Key Vault certificate whose policy names Self as the issuer.

#### Trust and validation

There is no `PENDING_VALIDATION` stage and no CNAME record to create: Key Vault issues the certificate as soon as its certificate operation completes. In exchange, browsers and other clients do not trust it until you distribute its root to them.

For a publicly trusted certificate you need a different issuer: a certificate authority (CA) that Key Vault integrates with, such as DigiCert or GlobalSign, or an App Service Managed Certificate for an eligible App Service hostname. Tensor9 does not set up either; you configure it.

![Key Vault creates and self-signs the certificate without a DNS challenge. Unlike an ACM public certificate, clients do not trust it until you distribute its root.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMzIwIiB2aWV3Qm94PSIwIDAgODM2IDMyMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJLZXkgVmF1bHQgY3JlYXRlcyBhbmQgc2VsZi1zaWducyB0aGUgY2VydGlmaWNhdGUgd2l0aG91dCBhIEROUyBjaGFsbGVuZ2UuIFVubGlrZSBhbiBBQ00gcHVibGljIGNlcnRpZmljYXRlLCBjbGllbnRzIGRvIG5vdCB0cnVzdCBpdCB1bnRpbCB5b3UgZGlzdHJpYnV0ZSBpdHMgcm9vdC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iYWNta3YzIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48bWFya2VyIGlkPSJhY21rdjNnIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiMwNDc4NTciLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI0IiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzMzNDE1NSI+S0VZIFZBVUxUIENSRUFURVMgQU5EIFNFTEYtU0lHTlMgVEhFIENFUlRJRklDQVRFPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMzYiIHdpZHRoPSIxOTYiIGhlaWdodD0iNDgiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiM0ZjQ2ZTUiLz4KPHRleHQgeD0iMTIyIiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzRmNDZlNSI+aXNzdWVyX3BhcmFtZXRlcnM8L3RleHQ+Cjx0ZXh0IHg9IjEyMiIgeT0iNzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPm5hbWUgPSBTZWxmPC90ZXh0Pgo8bGluZSB4MT0iMjIwIiB5MT0iNjAiIHgyPSIyNTIiIHkyPSI2MCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2FjbWt2MykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyNTYiIHk9IjM2IiB3aWR0aD0iMjI0IiBoZWlnaHQ9IjQ4IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjM2OCIgeT0iNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTFweCI+dGhlIHZhdWx0IGdlbmVyYXRlcyB0aGUga2V5PC90ZXh0Pgo8dGV4dCB4PSIzNjgiIHk9Ijc0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij5hbmQgc2VsZi1zaWducyB0aGUgY2VydGlmaWNhdGU8L3RleHQ+CjxsaW5lIHgxPSI0ODAiIHkxPSI2MCIgeDI9IjUxMiIgeTI9IjYwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjYWNta3YzZykiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPgo8cmVjdCB4PSI1MTYiIHk9IjM2IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjQ4IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjU5MSIgeT0iNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMwNDc4NTc7Zm9udC1zaXplOjEycHgiPklTU1VFRDwvdGV4dD4KPHRleHQgeD0iNTkxIiB5PSI3NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjlweCI+b3BlcmF0aW9uIGNvbXBsZXRlczwvdGV4dD4KPHRleHQgeD0iNjg2IiB5PSI1NCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNjQ3NDhiIj5ubyBQRU5ESU5HX1ZBTElEQVRJT04sPC90ZXh0Pgo8dGV4dCB4PSI2ODYiIHk9IjY4IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiM2NDc0OGIiPm5vIENOQU1FIGNoYWxsZW5nZSw8L3RleHQ+Cjx0ZXh0IHg9IjY4NiIgeT0iODIiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6IzY0NzQ4YiI+aXNzdWVkIGZyb20gdGhlIHBvbGljeTwvdGV4dD4KPGxpbmUgeDE9IjI0IiB5MT0iMTA0IiB4Mj0iODEyIiB5Mj0iMTA0IiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9InN0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjI0IiB5PSIxMzAiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMzMzQxNTUiPkNMSUVOVCBUUlVTVCBSRVFVSVJFTUVOVFM8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxNDIiIHdpZHRoPSIzNzIiIGhlaWdodD0iMTYyIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQwIiB5PSIxNjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPkFOIEFDTSBQVUJMSUMgQ0VSVElGSUNBVEUgwrcgVFJVU1RFRCwgTk8gU0VUVVA8L3RleHQ+CjxyZWN0IHg9IjEyOCIgeT0iMTc4IiB3aWR0aD0iMTY0IiBoZWlnaHQ9Ijk2IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiMwNDc4NTciLz4KPHBhdGggZD0iTTEyOCAxOTYgaDE2NCIgc3Ryb2tlLXdpZHRoPSIxIiBvcGFjaXR5PSIuMzUiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPgo8Y2lyY2xlIGN4PSIxMzkiIGN5PSIxODciIHI9IjIiIG9wYWNpdHk9Ii40NSIgc3R5bGU9ImZpbGw6IzA0Nzg1NyIvPjxjaXJjbGUgY3g9IjE0NiIgY3k9IjE4NyIgcj0iMiIgb3BhY2l0eT0iLjQ1IiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PGNpcmNsZSBjeD0iMTUzIiBjeT0iMTg3IiByPSIyIiBvcGFjaXR5PSIuNDUiIHN0eWxlPSJmaWxsOiMwNDc4NTciLz4KPHJlY3QgeD0iMTQ2IiB5PSIyMDQiIHdpZHRoPSIxMjgiIGhlaWdodD0iMTYiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiMwNDc4NTciLz4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMTU0LDIwMykgc2NhbGUoMC42MikiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PC9nPgo8dGV4dCB4PSIxNzYiIHk9IjIxNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiMzMzQxNTUiPmV4YW1wbGUuY29tPC90ZXh0Pgo8dGV4dCB4PSIyMTAiIHk9IjI0NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDExcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTUiPkFXUyBBQ008L3RleHQ+Cjx0ZXh0IHg9IjIxMCIgeT0iMjYyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgOS41cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiMwNDc4NTciPmJyb3dzZXItdHJ1c3RlZDwvdGV4dD4KPHJlY3QgeD0iNDIwIiB5PSIxNDIiIHdpZHRoPSIzOTIiIGhlaWdodD0iMTYyIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmYmViO3N0cm9rZTojZjU5ZTBiIi8+Cjx0ZXh0IHg9IjQzNiIgeT0iMTY0IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojYjQ1MzA5Ij5BIFNFTEYtU0lHTkVEIFZBVUxUIENFUlRJRklDQVRFIMK3IE5PVCBUUlVTVEVEPC90ZXh0Pgo8cmVjdCB4PSI0NTIiIHk9IjE3OCIgd2lkdGg9IjE2NCIgaGVpZ2h0PSI5NiIgcng9IjgiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojYjQ1MzA5Ii8+CjxwYXRoIGQ9Ik00NTIgMTk2IGgxNjQiIHN0cm9rZS13aWR0aD0iMSIgb3BhY2l0eT0iLjM1IiBzdHlsZT0ic3Ryb2tlOiNiNDUzMDkiLz4KPGNpcmNsZSBjeD0iNDYzIiBjeT0iMTg3IiByPSIyIiBvcGFjaXR5PSIuNDUiIHN0eWxlPSJmaWxsOiNiNDUzMDkiLz48Y2lyY2xlIGN4PSI0NzAiIGN5PSIxODciIHI9IjIiIG9wYWNpdHk9Ii40NSIgc3R5bGU9ImZpbGw6I2I0NTMwOSIvPjxjaXJjbGUgY3g9IjQ3NyIgY3k9IjE4NyIgcj0iMiIgb3BhY2l0eT0iLjQ1IiBzdHlsZT0iZmlsbDojYjQ1MzA5Ii8+CjxyZWN0IHg9IjQ3MCIgeT0iMjA0IiB3aWR0aD0iMTI4IiBoZWlnaHQ9IjE2IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojYjQ1MzA5Ii8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDQ3OCwyMDMpIHNjYWxlKDAuNjIpIj48cGF0aCBkPSJNNCA4IFY2IGE1IDUgMCAwIDEgNi41IC0zLjYiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMS43IiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0eWxlPSJzdHJva2U6I2I0NTMwOSIvPjxwYXRoIGQ9Ik0xNCA4IFY2IGE1IDUgMCAwIDAgLTEuNCAtMy41IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIiBzdHlsZT0ic3Ryb2tlOiNiNDUzMDkiLz48cmVjdCB4PSIyIiB5PSI4IiB3aWR0aD0iMTQiIGhlaWdodD0iMTEiIHJ4PSIyLjIiIHN0eWxlPSJmaWxsOiNiNDUzMDkiLz48cGF0aCBkPSJNOSAxMSBsLTEuNCAzIGgyLjggbC0xLjQgMyIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIHN0cm9rZS1saW5lY2FwPSJyb3VuZCIgc3R5bGU9InN0cm9rZTojZmZmZmZmIi8+PC9nPgo8dGV4dCB4PSI1MDAiIHk9IjIxNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiMzMzQxNTUiPmV4YW1wbGUuY29tPC90ZXh0Pgo8dGV4dCB4PSI1MzQiIHk9IjI0NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDExcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiM0ZjQ2ZTUiPkF6dXJlIHNlbGYtc2lnbmVkPC90ZXh0Pgo8dGV4dCB4PSI1MzQiIHk9IjI2MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDkuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYjQ1MzA5Ij5ub3QgdHJ1c3RlZDwvdGV4dD4KPHRleHQgeD0iNzAwIiB5PSIxOTIiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6I2I0NTMwOSI+YSBicm93c2VyIHdhcm5zIHVubGVzczwvdGV4dD4KPHRleHQgeD0iNzAwIiB5PSIyMDYiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6I2I0NTMwOSI+dGhlIHJvb3QgaXMgZGlzdHJpYnV0ZWQuPC90ZXh0Pgo8dGV4dCB4PSI3MDAiIHk9IjIyNiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojYjQ1MzA5Ij5wdWJsaWMgdHJ1c3QgbmVlZHMgYTwvdGV4dD4KPHRleHQgeD0iNzAwIiB5PSIyNDAiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6I2I0NTMwOSI+cGFydG5lciBDQSAoRGlnaUNlcnQsPC90ZXh0Pgo8dGV4dCB4PSI3MDAiIHk9IjI1NCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojYjQ1MzA5Ij5HbG9iYWxTaWduKSBvciBhbiBBcHA8L3RleHQ+Cjx0ZXh0IHg9IjcwMCIgeT0iMjY4IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiNiNDUzMDkiPlNlcnZpY2UgTWFuYWdlZCBDZXJ0PC90ZXh0Pgo8L3N2Zz4=)

![Key Vault creates and self-signs the certificate without a DNS challenge. Unlike an ACM public certificate, clients do not trust it until you distribute its root.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMzIwIiB2aWV3Qm94PSIwIDAgODM2IDMyMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJLZXkgVmF1bHQgY3JlYXRlcyBhbmQgc2VsZi1zaWducyB0aGUgY2VydGlmaWNhdGUgd2l0aG91dCBhIEROUyBjaGFsbGVuZ2UuIFVubGlrZSBhbiBBQ00gcHVibGljIGNlcnRpZmljYXRlLCBjbGllbnRzIGRvIG5vdCB0cnVzdCBpdCB1bnRpbCB5b3UgZGlzdHJpYnV0ZSBpdHMgcm9vdC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iYWNta3YzIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48bWFya2VyIGlkPSJhY21rdjNnIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2ZWU3YjciLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI0IiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2NiZDVlMSI+S0VZIFZBVUxUIENSRUFURVMgQU5EIFNFTEYtU0lHTlMgVEhFIENFUlRJRklDQVRFPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMzYiIHdpZHRoPSIxOTYiIGhlaWdodD0iNDgiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiNhNWI0ZmMiLz4KPHRleHQgeD0iMTIyIiB5PSI1OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2E1YjRmYyI+aXNzdWVyX3BhcmFtZXRlcnM8L3RleHQ+Cjx0ZXh0IHg9IjEyMiIgeT0iNzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPm5hbWUgPSBTZWxmPC90ZXh0Pgo8bGluZSB4MT0iMjIwIiB5MT0iNjAiIHgyPSIyNTIiIHkyPSI2MCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2FjbWt2MykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyNTYiIHk9IjM2IiB3aWR0aD0iMjI0IiBoZWlnaHQ9IjQ4IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjM2OCIgeT0iNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTFweCI+dGhlIHZhdWx0IGdlbmVyYXRlcyB0aGUga2V5PC90ZXh0Pgo8dGV4dCB4PSIzNjgiIHk9Ijc0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij5hbmQgc2VsZi1zaWducyB0aGUgY2VydGlmaWNhdGU8L3RleHQ+CjxsaW5lIHgxPSI0ODAiIHkxPSI2MCIgeDI9IjUxMiIgeTI9IjYwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjYWNta3YzZykiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPgo8cmVjdCB4PSI1MTYiIHk9IjM2IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjQ4IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjU5MSIgeT0iNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiM2ZWU3Yjc7Zm9udC1zaXplOjEycHgiPklTU1VFRDwvdGV4dD4KPHRleHQgeD0iNTkxIiB5PSI3NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjlweCI+b3BlcmF0aW9uIGNvbXBsZXRlczwvdGV4dD4KPHRleHQgeD0iNjg2IiB5PSI1NCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojOTRhM2I4Ij5ubyBQRU5ESU5HX1ZBTElEQVRJT04sPC90ZXh0Pgo8dGV4dCB4PSI2ODYiIHk9IjY4IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiM5NGEzYjgiPm5vIENOQU1FIGNoYWxsZW5nZSw8L3RleHQ+Cjx0ZXh0IHg9IjY4NiIgeT0iODIiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6Izk0YTNiOCI+aXNzdWVkIGZyb20gdGhlIHBvbGljeTwvdGV4dD4KPGxpbmUgeDE9IjI0IiB5MT0iMTA0IiB4Mj0iODEyIiB5Mj0iMTA0IiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9InN0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjI0IiB5PSIxMzAiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiNjYmQ1ZTEiPkNMSUVOVCBUUlVTVCBSRVFVSVJFTUVOVFM8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxNDIiIHdpZHRoPSIzNzIiIGhlaWdodD0iMTYyIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjQwIiB5PSIxNjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPkFOIEFDTSBQVUJMSUMgQ0VSVElGSUNBVEUgwrcgVFJVU1RFRCwgTk8gU0VUVVA8L3RleHQ+CjxyZWN0IHg9IjEyOCIgeT0iMTc4IiB3aWR0aD0iMTY0IiBoZWlnaHQ9Ijk2IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHBhdGggZD0iTTEyOCAxOTYgaDE2NCIgc3Ryb2tlLXdpZHRoPSIxIiBvcGFjaXR5PSIuMzUiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPgo8Y2lyY2xlIGN4PSIxMzkiIGN5PSIxODciIHI9IjIiIG9wYWNpdHk9Ii40NSIgc3R5bGU9ImZpbGw6IzZlZTdiNyIvPjxjaXJjbGUgY3g9IjE0NiIgY3k9IjE4NyIgcj0iMiIgb3BhY2l0eT0iLjQ1IiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PGNpcmNsZSBjeD0iMTUzIiBjeT0iMTg3IiByPSIyIiBvcGFjaXR5PSIuNDUiIHN0eWxlPSJmaWxsOiM2ZWU3YjciLz4KPHJlY3QgeD0iMTQ2IiB5PSIyMDQiIHdpZHRoPSIxMjgiIGhlaWdodD0iMTYiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM2ZWU3YjciLz4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMTU0LDIwMykgc2NhbGUoMC42MikiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PC9nPgo8dGV4dCB4PSIxNzYiIHk9IjIxNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNjYmQ1ZTEiPmV4YW1wbGUuY29tPC90ZXh0Pgo8dGV4dCB4PSIyMTAiIHk9IjI0NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDExcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTEiPkFXUyBBQ008L3RleHQ+Cjx0ZXh0IHg9IjIxMCIgeT0iMjYyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgOS41cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiM2ZWU3YjciPmJyb3dzZXItdHJ1c3RlZDwvdGV4dD4KPHJlY3QgeD0iNDIwIiB5PSIxNDIiIHdpZHRoPSIzOTIiIGhlaWdodD0iMTYyIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojNDIyMDA2O3N0cm9rZTojZmJiZjI0Ii8+Cjx0ZXh0IHg9IjQzNiIgeT0iMTY0IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojZmJiZjI0Ij5BIFNFTEYtU0lHTkVEIFZBVUxUIENFUlRJRklDQVRFIMK3IE5PVCBUUlVTVEVEPC90ZXh0Pgo8cmVjdCB4PSI0NTIiIHk9IjE3OCIgd2lkdGg9IjE2NCIgaGVpZ2h0PSI5NiIgcng9IjgiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojZmJiZjI0Ii8+CjxwYXRoIGQ9Ik00NTIgMTk2IGgxNjQiIHN0cm9rZS13aWR0aD0iMSIgb3BhY2l0eT0iLjM1IiBzdHlsZT0ic3Ryb2tlOiNmYmJmMjQiLz4KPGNpcmNsZSBjeD0iNDYzIiBjeT0iMTg3IiByPSIyIiBvcGFjaXR5PSIuNDUiIHN0eWxlPSJmaWxsOiNmYmJmMjQiLz48Y2lyY2xlIGN4PSI0NzAiIGN5PSIxODciIHI9IjIiIG9wYWNpdHk9Ii40NSIgc3R5bGU9ImZpbGw6I2ZiYmYyNCIvPjxjaXJjbGUgY3g9IjQ3NyIgY3k9IjE4NyIgcj0iMiIgb3BhY2l0eT0iLjQ1IiBzdHlsZT0iZmlsbDojZmJiZjI0Ii8+CjxyZWN0IHg9IjQ3MCIgeT0iMjA0IiB3aWR0aD0iMTI4IiBoZWlnaHQ9IjE2IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojZmJiZjI0Ii8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDQ3OCwyMDMpIHNjYWxlKDAuNjIpIj48cGF0aCBkPSJNNCA4IFY2IGE1IDUgMCAwIDEgNi41IC0zLjYiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMS43IiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0eWxlPSJzdHJva2U6I2ZiYmYyNCIvPjxwYXRoIGQ9Ik0xNCA4IFY2IGE1IDUgMCAwIDAgLTEuNCAtMy41IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIiBzdHlsZT0ic3Ryb2tlOiNmYmJmMjQiLz48cmVjdCB4PSIyIiB5PSI4IiB3aWR0aD0iMTQiIGhlaWdodD0iMTEiIHJ4PSIyLjIiIHN0eWxlPSJmaWxsOiNmYmJmMjQiLz48cGF0aCBkPSJNOSAxMSBsLTEuNCAzIGgyLjggbC0xLjQgMyIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIHN0cm9rZS1saW5lY2FwPSJyb3VuZCIgc3R5bGU9InN0cm9rZTojMWUyOTNiIi8+PC9nPgo8dGV4dCB4PSI1MDAiIHk9IjIxNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNjYmQ1ZTEiPmV4YW1wbGUuY29tPC90ZXh0Pgo8dGV4dCB4PSI1MzQiIHk9IjI0NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDExcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNhNWI0ZmMiPkF6dXJlIHNlbGYtc2lnbmVkPC90ZXh0Pgo8dGV4dCB4PSI1MzQiIHk9IjI2MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDkuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojZmJiZjI0Ij5ub3QgdHJ1c3RlZDwvdGV4dD4KPHRleHQgeD0iNzAwIiB5PSIxOTIiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6I2ZiYmYyNCI+YSBicm93c2VyIHdhcm5zIHVubGVzczwvdGV4dD4KPHRleHQgeD0iNzAwIiB5PSIyMDYiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6I2ZiYmYyNCI+dGhlIHJvb3QgaXMgZGlzdHJpYnV0ZWQuPC90ZXh0Pgo8dGV4dCB4PSI3MDAiIHk9IjIyNiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojZmJiZjI0Ij5wdWJsaWMgdHJ1c3QgbmVlZHMgYTwvdGV4dD4KPHRleHQgeD0iNzAwIiB5PSIyNDAiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6I2ZiYmYyNCI+cGFydG5lciBDQSAoRGlnaUNlcnQsPC90ZXh0Pgo8dGV4dCB4PSI3MDAiIHk9IjI1NCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojZmJiZjI0Ij5HbG9iYWxTaWduKSBvciBhbiBBcHA8L3RleHQ+Cjx0ZXh0IHg9IjcwMCIgeT0iMjY4IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiNmYmJmMjQiPlNlcnZpY2UgTWFuYWdlZCBDZXJ0PC90ZXh0Pgo8L3N2Zz4=)

Key Vault issues the self-signed certificate without a DNS challenge. Clients must be configured to trust it.

#### Getting a publicly trusted certificate

If your TLS endpoint is an App Service, you can create an `azurerm_app_service_managed_certificate` yourself. It uses an existing `custom_hostname_binding` to validate the hostname. Azure and DigiCert issue a publicly trusted certificate, and Microsoft renews it at no certificate charge.

It covers one exact hostname, does not support wildcards, and needs an internet-reachable App Service for validation. It cannot be attached to an arbitrary load balancer. Use a partner CA when these restrictions do not fit your deployment.

![An App Service Managed Certificate is validated through the App Service hostname binding, issued by Azure and DigiCert, publicly trusted and renewed automatically. It covers one exact, internet-reachable App Service hostname and no wildcards.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjQwIiB2aWV3Qm94PSIwIDAgODM2IDI0MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBBcHAgU2VydmljZSBNYW5hZ2VkIENlcnRpZmljYXRlIGlzIHZhbGlkYXRlZCB0aHJvdWdoIHRoZSBBcHAgU2VydmljZSBob3N0bmFtZSBiaW5kaW5nLCBpc3N1ZWQgYnkgQXp1cmUgYW5kIERpZ2lDZXJ0LCBwdWJsaWNseSB0cnVzdGVkIGFuZCByZW5ld2VkIGF1dG9tYXRpY2FsbHkuIEl0IGNvdmVycyBvbmUgZXhhY3QsIGludGVybmV0LXJlYWNoYWJsZSBBcHAgU2VydmljZSBob3N0bmFtZSBhbmQgbm8gd2lsZGNhcmRzLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJhY21rdjQiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImFjbWt2NGciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzA0Nzg1NyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjQiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNGY0NmU1Ij5BUFAgU0VSVklDRSBNQU5BR0VEIENFUlRJRklDQVRFIMK3IGF6dXJlcm1fYXBwX3NlcnZpY2VfbWFuYWdlZF9jZXJ0aWZpY2F0ZTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjQ0IiB3aWR0aD0iMTk2IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjEyMiIgeT0iNjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTAuNXB4Ij5jdXN0b21faG9zdG5hbWVfYmluZGluZzwvdGV4dD4KPHRleHQgeD0iMTIyIiB5PSI4NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+eW91ciBBcHAgU2VydmljZSBob3N0bmFtZTwvdGV4dD4KPGxpbmUgeDE9IjIyMCIgeTE9Ijc0IiB4Mj0iMjU2IiB5Mj0iNzQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNhY21rdjQpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iMjM4IiB5PSI2NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo3LjVweCI+dmFsaWRhdGVzPC90ZXh0Pgo8cmVjdCB4PSIyNjAiIHk9IjQ0IiB3aWR0aD0iMjAwIiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNGY0NmU1Ii8+Cjx0ZXh0IHg9IjM2MCIgeT0iNjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTFweDtmaWxsOiM0ZjQ2ZTUiPkF6dXJlICsgRGlnaUNlcnQ8L3RleHQ+Cjx0ZXh0IHg9IjM2MCIgeT0iODYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPmlzc3VlIGEgbWFuYWdlZCBjZXJ0aWZpY2F0ZTwvdGV4dD4KPGxpbmUgeDE9IjQ2MCIgeTE9Ijc0IiB4Mj0iNDk2IiB5Mj0iNzQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNhY21rdjRnKSIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+CjxyZWN0IHg9IjUwMCIgeT0iNDAiIHdpZHRoPSIyODgiIGhlaWdodD0iNjgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoNTE2LDYwKSBzY2FsZSgwLjkpIj48cGF0aCBkPSJNNCA4IFY2IGE1IDUgMCAwIDEgMTAgMCBWOCIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPjxyZWN0IHg9IjIiIHk9IjgiIHdpZHRoPSIxNCIgaGVpZ2h0PSIxMSIgcng9IjIuMiIgc3R5bGU9ImZpbGw6IzA0Nzg1NyIvPjxjaXJjbGUgY3g9IjkiIGN5PSIxMi41IiByPSIxLjciIHN0eWxlPSJmaWxsOiNmZmZmZmYiLz48cmVjdCB4PSI4LjIiIHk9IjEzIiB3aWR0aD0iMS42IiBoZWlnaHQ9IjMuNiIgcng9IjAuOCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjwvZz4KPHRleHQgeD0iNjA0IiB5PSI2NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMXB4Ij5wdWJsaWNseSB0cnVzdGVkPC90ZXh0Pgo8dGV4dCB4PSI2MDQiIHk9IjgzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6OS41cHgiPmZyZWUgwrcgTWljcm9zb2Z0LW1hbmFnZWQgwrcgYXV0by1yZW5ld2VkPC90ZXh0Pgo8dGV4dCB4PSI2MDQiIHk9Ijk3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+Y2hlY2tlZCB0aHJvdWdoIHRoZSBob3N0bmFtZTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjEyOCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSI5NiIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6I2ZmZmJlYjtzdHJva2U6I2ZkZTY4YSIvPgo8dGV4dCB4PSI0MCIgeT0iMTUwIiBzdHlsZT0iZm9udDo3MDAgMTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYjQ1MzA5Ij5BUFAgU0VSVklDRSBSRVFVSVJFTUVOVFM8L3RleHQ+CjxyZWN0IHg9IjQwIiB5PSIxNjIiIHdpZHRoPSIyNDAiIGhlaWdodD0iNDgiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2ZkZTY4YSIvPgo8dGV4dCB4PSIxNjAiIHk9IjE4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDEwcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNiNDUzMDkiPm5vIHdpbGRjYXJkPC90ZXh0Pgo8dGV4dCB4PSIxNjAiIHk9IjE5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojYjQ1MzA5Ij5hIHNpbmdsZSBleGFjdCBob3N0bmFtZSBvbmx5PC90ZXh0Pgo8cmVjdCB4PSIyOTYiIHk9IjE2MiIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI0OCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojZmRlNjhhIi8+Cjx0ZXh0IHg9IjQxNiIgeT0iMTgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTBweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2I0NTMwOSI+c2NvcGVkIHRvIG9uZSBBcHAgU2VydmljZTwvdGV4dD4KPHRleHQgeD0iNDE2IiB5PSIxOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6I2I0NTMwOSI+bm90IGEgZ2VuZXJhbCBsb2FkIGJhbGFuY2VyPC90ZXh0Pgo8cmVjdCB4PSI1NTIiIHk9IjE2MiIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI0OCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojZmRlNjhhIi8+Cjx0ZXh0IHg9IjY3MiIgeT0iMTgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTBweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2I0NTMwOSI+bXVzdCBiZSBpbnRlcm5ldC1yZWFjaGFibGU8L3RleHQ+Cjx0ZXh0IHg9IjY3MiIgeT0iMTk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiNiNDUzMDkiPmZvciB2YWxpZGF0aW9uPC90ZXh0Pgo8L3N2Zz4=)

![An App Service Managed Certificate is validated through the App Service hostname binding, issued by Azure and DigiCert, publicly trusted and renewed automatically. It covers one exact, internet-reachable App Service hostname and no wildcards.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjQwIiB2aWV3Qm94PSIwIDAgODM2IDI0MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBBcHAgU2VydmljZSBNYW5hZ2VkIENlcnRpZmljYXRlIGlzIHZhbGlkYXRlZCB0aHJvdWdoIHRoZSBBcHAgU2VydmljZSBob3N0bmFtZSBiaW5kaW5nLCBpc3N1ZWQgYnkgQXp1cmUgYW5kIERpZ2lDZXJ0LCBwdWJsaWNseSB0cnVzdGVkIGFuZCByZW5ld2VkIGF1dG9tYXRpY2FsbHkuIEl0IGNvdmVycyBvbmUgZXhhY3QsIGludGVybmV0LXJlYWNoYWJsZSBBcHAgU2VydmljZSBob3N0bmFtZSBhbmQgbm8gd2lsZGNhcmRzLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJhY21rdjQiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImFjbWt2NGciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzZlZTdiNyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjQiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojYTViNGZjIj5BUFAgU0VSVklDRSBNQU5BR0VEIENFUlRJRklDQVRFIMK3IGF6dXJlcm1fYXBwX3NlcnZpY2VfbWFuYWdlZF9jZXJ0aWZpY2F0ZTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjQ0IiB3aWR0aD0iMTk2IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjEyMiIgeT0iNjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTAuNXB4Ij5jdXN0b21faG9zdG5hbWVfYmluZGluZzwvdGV4dD4KPHRleHQgeD0iMTIyIiB5PSI4NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+eW91ciBBcHAgU2VydmljZSBob3N0bmFtZTwvdGV4dD4KPGxpbmUgeDE9IjIyMCIgeTE9Ijc0IiB4Mj0iMjU2IiB5Mj0iNzQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNhY21rdjQpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iMjM4IiB5PSI2NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo3LjVweCI+dmFsaWRhdGVzPC90ZXh0Pgo8cmVjdCB4PSIyNjAiIHk9IjQ0IiB3aWR0aD0iMjAwIiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojYTViNGZjIi8+Cjx0ZXh0IHg9IjM2MCIgeT0iNjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTFweDtmaWxsOiNhNWI0ZmMiPkF6dXJlICsgRGlnaUNlcnQ8L3RleHQ+Cjx0ZXh0IHg9IjM2MCIgeT0iODYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPmlzc3VlIGEgbWFuYWdlZCBjZXJ0aWZpY2F0ZTwvdGV4dD4KPGxpbmUgeDE9IjQ2MCIgeTE9Ijc0IiB4Mj0iNDk2IiB5Mj0iNzQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNhY21rdjRnKSIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+CjxyZWN0IHg9IjUwMCIgeT0iNDAiIHdpZHRoPSIyODgiIGhlaWdodD0iNjgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoNTE2LDYwKSBzY2FsZSgwLjkpIj48cGF0aCBkPSJNNCA4IFY2IGE1IDUgMCAwIDEgMTAgMCBWOCIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPjxyZWN0IHg9IjIiIHk9IjgiIHdpZHRoPSIxNCIgaGVpZ2h0PSIxMSIgcng9IjIuMiIgc3R5bGU9ImZpbGw6IzZlZTdiNyIvPjxjaXJjbGUgY3g9IjkiIGN5PSIxMi41IiByPSIxLjciIHN0eWxlPSJmaWxsOiMxZTI5M2IiLz48cmVjdCB4PSI4LjIiIHk9IjEzIiB3aWR0aD0iMS42IiBoZWlnaHQ9IjMuNiIgcng9IjAuOCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjwvZz4KPHRleHQgeD0iNjA0IiB5PSI2NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMXB4Ij5wdWJsaWNseSB0cnVzdGVkPC90ZXh0Pgo8dGV4dCB4PSI2MDQiIHk9IjgzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6OS41cHgiPmZyZWUgwrcgTWljcm9zb2Z0LW1hbmFnZWQgwrcgYXV0by1yZW5ld2VkPC90ZXh0Pgo8dGV4dCB4PSI2MDQiIHk9Ijk3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+Y2hlY2tlZCB0aHJvdWdoIHRoZSBob3N0bmFtZTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjEyOCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSI5NiIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6IzQyMjAwNjtzdHJva2U6IzkyNDAwZSIvPgo8dGV4dCB4PSI0MCIgeT0iMTUwIiBzdHlsZT0iZm9udDo3MDAgMTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojZmJiZjI0Ij5BUFAgU0VSVklDRSBSRVFVSVJFTUVOVFM8L3RleHQ+CjxyZWN0IHg9IjQwIiB5PSIxNjIiIHdpZHRoPSIyNDAiIGhlaWdodD0iNDgiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzkyNDAwZSIvPgo8dGV4dCB4PSIxNjAiIHk9IjE4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDEwcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNmYmJmMjQiPm5vIHdpbGRjYXJkPC90ZXh0Pgo8dGV4dCB4PSIxNjAiIHk9IjE5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojZmJiZjI0Ij5hIHNpbmdsZSBleGFjdCBob3N0bmFtZSBvbmx5PC90ZXh0Pgo8cmVjdCB4PSIyOTYiIHk9IjE2MiIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI0OCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojOTI0MDBlIi8+Cjx0ZXh0IHg9IjQxNiIgeT0iMTgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTBweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2ZiYmYyNCI+c2NvcGVkIHRvIG9uZSBBcHAgU2VydmljZTwvdGV4dD4KPHRleHQgeD0iNDE2IiB5PSIxOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6I2ZiYmYyNCI+bm90IGEgZ2VuZXJhbCBsb2FkIGJhbGFuY2VyPC90ZXh0Pgo8cmVjdCB4PSI1NTIiIHk9IjE2MiIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI0OCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojOTI0MDBlIi8+Cjx0ZXh0IHg9IjY3MiIgeT0iMTgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTBweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2ZiYmYyNCI+bXVzdCBiZSBpbnRlcm5ldC1yZWFjaGFibGU8L3RleHQ+Cjx0ZXh0IHg9IjY3MiIgeT0iMTk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiNmYmJmMjQiPmZvciB2YWxpZGF0aW9uPC90ZXh0Pgo8L3N2Zz4=)

App Service Managed Certificates are publicly trusted and renew automatically. They cover one reachable App Service hostname and no wildcards.

#### Private key access

ACM's `GetCertificate` returns the certificate and chain without the key. Default public certificates are non-exportable; ACM has offered opt-in exportable public certificates since 2025.

Tensor9 sets `key_properties.exportable = true` on every certificate it creates, so anyone allowed to read the backing Key Vault secret can retrieve the private key. Restrict read access to that secret. To prevent export altogether, the certificate policy would need `exportable = false` or a non-exportable `RSA-HSM` or `EC-HSM` key, which is a change from what Tensor9 generates.

![ACM returns a default certificate and chain but never its private key. The Key Vault certificate is exportable, so anyone who can read its backing secret can read the private key.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjAwIiB2aWV3Qm94PSIwIDAgODM2IDIwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gcmV0dXJucyBhIGRlZmF1bHQgY2VydGlmaWNhdGUgYW5kIGNoYWluIGJ1dCBuZXZlciBpdHMgcHJpdmF0ZSBrZXkuIFRoZSBLZXkgVmF1bHQgY2VydGlmaWNhdGUgaXMgZXhwb3J0YWJsZSwgc28gYW55b25lIHdobyBjYW4gcmVhZCBpdHMgYmFja2luZyBzZWNyZXQgY2FuIHJlYWQgdGhlIHByaXZhdGUga2V5LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJhY21rdjUiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImFjbWt2NWEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6I2I0NTMwOSIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjM0IiB3aWR0aD0iMzg2IiBoZWlnaHQ9IjE1MCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwIiB5PSI1NCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+QSBERUZBVUxUIEFDTSBDRVJUSUZJQ0FURSDCtyBLRVkgV0lUSEhFTEQ8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSI3MiIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI1NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI5MCIgeT0iOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTFweCI+QUNNIGNlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSI5MCIgeT0iMTEzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+cHVibGljIGNlcnRpZmljYXRlPC90ZXh0Pgo8bGluZSB4MT0iMTUwIiB5MT0iMTAwIiB4Mj0iMTcyIiB5Mj0iMTAwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjYWNta3Y1KSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjE3NiIgeT0iNzIiIHdpZHRoPSIyMTAiIGhlaWdodD0iMjYiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIyODEiIHk9Ijg5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzMzNDE1NSI+Y2VydGlmaWNhdGUgKyBjaGFpbiDinJMgcmV0dXJuZWQ8L3RleHQ+CjxyZWN0IHg9IjE3NiIgeT0iMTA0IiB3aWR0aD0iMjEwIiBoZWlnaHQ9IjQyIiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgxOTAsMTE2KSBzY2FsZSgwLjk1KSI+PHBhdGggZD0iTTQgOCBWNiBhNSA1IDAgMCAxIDEwIDAgVjgiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0ic3Ryb2tlOiMzMzQxNTUiLz48cmVjdCB4PSIyIiB5PSI4IiB3aWR0aD0iMTQiIGhlaWdodD0iMTEiIHJ4PSIyLjIiIHN0eWxlPSJmaWxsOiMzMzQxNTUiLz48Y2lyY2xlIGN4PSI5IiBjeT0iMTIuNSIgcj0iMS43IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PHJlY3QgeD0iOC4yIiB5PSIxMyIgd2lkdGg9IjEuNiIgaGVpZ2h0PSIzLjYiIHJ4PSIwLjgiIHN0eWxlPSJmaWxsOiNmZmZmZmYiLz48L2c+Cjx0ZXh0IHg9IjI5OCIgeT0iMTIwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzMzNDE1NSI+cHJpdmF0ZSBrZXk8L3RleHQ+Cjx0ZXh0IHg9IjI5OCIgeT0iMTM1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4Ij5uZXZlciByZXR1cm5lZCBieSBHZXRDZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iMjA5IiB5PSIxNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij50aGUga2V5IGlzIG5ldmVyIHJldHJpZXZhYmxlPC90ZXh0Pgo8bGluZSB4MT0iNDE4IiB5MT0iNDAiIHgyPSI0MTgiIHkyPSIxNzgiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0ic3Ryb2tlOiNjYmQ1ZTEiLz4KPHJlY3QgeD0iNDM0IiB5PSIzNCIgd2lkdGg9IjM4NiIgaGVpZ2h0PSIxNTAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZiZWI7c3Ryb2tlOiNmNTllMGIiLz4KPHRleHQgeD0iNDQ4IiB5PSI1NCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6I2I0NTMwOSI+VEhFIFZBVUxUIENFUlRJRklDQVRFIMK3IGV4cG9ydGFibGUgPSB0cnVlPC90ZXh0Pgo8cmVjdCB4PSI0NDgiIHk9IjcyIiB3aWR0aD0iMTIwIiBoZWlnaHQ9IjU2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojZmRlNjhhIi8+Cjx0ZXh0IHg9IjUwOCIgeT0iOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTAuNXB4O2ZpbGw6IzRmNDZlNSI+dmF1bHQgY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjUwOCIgeT0iMTEzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+a2V5X3Byb3BlcnRpZXM8L3RleHQ+CjxsaW5lIHgxPSI1NjgiIHkxPSIxMDAiIHgyPSI1OTAiIHkyPSIxMDAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNhY21rdjVhKSIgc3R5bGU9InN0cm9rZTojYjQ1MzA5Ii8+CjxyZWN0IHg9IjU5NCIgeT0iNzIiIHdpZHRoPSIyMTIiIGhlaWdodD0iNzQiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNmZGU2OGEiLz4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoNjA4LDg4KSBzY2FsZSgxLjApIj48cGF0aCBkPSJNNCA4IFY2IGE1IDUgMCAwIDEgOS42IC0xLjkiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0ic3Ryb2tlOiNiNDUzMDkiLz48cmVjdCB4PSIyIiB5PSI4IiB3aWR0aD0iMTQiIGhlaWdodD0iMTEiIHJ4PSIyLjIiIHN0eWxlPSJmaWxsOiNiNDUzMDkiLz48Y2lyY2xlIGN4PSI5IiBjeT0iMTIuNSIgcj0iMS43IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PHJlY3QgeD0iOC4yIiB5PSIxMyIgd2lkdGg9IjEuNiIgaGVpZ2h0PSIzLjYiIHJ4PSIwLjgiIHN0eWxlPSJmaWxsOiNmZmZmZmYiLz48L2c+Cjx0ZXh0IHg9IjcxMiIgeT0iOTQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMHB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYjQ1MzA5Ij5wcml2YXRlIGtleSDCtyByZWFkYWJsZTwvdGV4dD4KPHRleHQgeD0iNzAwIiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6I2I0NTMwOSI+cmV0cmlldmFibGUgdGhyb3VnaCB0aGU8L3RleHQ+Cjx0ZXh0IHg9IjcwMCIgeT0iMTI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiNiNDUzMDkiPmJhY2tpbmcgS2V5IFZhdWx0IHNlY3JldDwvdGV4dD4KPHRleHQgeD0iNjI3IiB5PSIxNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6I2I0NTMwOSI+TGltaXQgd2hvIGNhbiByZWFkIHRoZSBiYWNraW5nIHNlY3JldDwvdGV4dD4KPC9zdmc+)

![ACM returns a default certificate and chain but never its private key. The Key Vault certificate is exportable, so anyone who can read its backing secret can read the private key.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjAwIiB2aWV3Qm94PSIwIDAgODM2IDIwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gcmV0dXJucyBhIGRlZmF1bHQgY2VydGlmaWNhdGUgYW5kIGNoYWluIGJ1dCBuZXZlciBpdHMgcHJpdmF0ZSBrZXkuIFRoZSBLZXkgVmF1bHQgY2VydGlmaWNhdGUgaXMgZXhwb3J0YWJsZSwgc28gYW55b25lIHdobyBjYW4gcmVhZCBpdHMgYmFja2luZyBzZWNyZXQgY2FuIHJlYWQgdGhlIHByaXZhdGUga2V5LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJhY21rdjUiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImFjbWt2NWEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6I2ZiYmYyNCIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjM0IiB3aWR0aD0iMzg2IiBoZWlnaHQ9IjE1MCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwIiB5PSI1NCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+QSBERUZBVUxUIEFDTSBDRVJUSUZJQ0FURSDCtyBLRVkgV0lUSEhFTEQ8L3RleHQ+CjxyZWN0IHg9IjMwIiB5PSI3MiIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI1NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI5MCIgeT0iOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTFweCI+QUNNIGNlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSI5MCIgeT0iMTEzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+cHVibGljIGNlcnRpZmljYXRlPC90ZXh0Pgo8bGluZSB4MT0iMTUwIiB5MT0iMTAwIiB4Mj0iMTcyIiB5Mj0iMTAwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjYWNta3Y1KSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjE3NiIgeT0iNzIiIHdpZHRoPSIyMTAiIGhlaWdodD0iMjYiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIyODEiIHk9Ijg5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2NiZDVlMSI+Y2VydGlmaWNhdGUgKyBjaGFpbiDinJMgcmV0dXJuZWQ8L3RleHQ+CjxyZWN0IHg9IjE3NiIgeT0iMTA0IiB3aWR0aD0iMjEwIiBoZWlnaHQ9IjQyIiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgxOTAsMTE2KSBzY2FsZSgwLjk1KSI+PHBhdGggZD0iTTQgOCBWNiBhNSA1IDAgMCAxIDEwIDAgVjgiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0ic3Ryb2tlOiNjYmQ1ZTEiLz48cmVjdCB4PSIyIiB5PSI4IiB3aWR0aD0iMTQiIGhlaWdodD0iMTEiIHJ4PSIyLjIiIHN0eWxlPSJmaWxsOiNjYmQ1ZTEiLz48Y2lyY2xlIGN4PSI5IiBjeT0iMTIuNSIgcj0iMS43IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PHJlY3QgeD0iOC4yIiB5PSIxMyIgd2lkdGg9IjEuNiIgaGVpZ2h0PSIzLjYiIHJ4PSIwLjgiIHN0eWxlPSJmaWxsOiMxZTI5M2IiLz48L2c+Cjx0ZXh0IHg9IjI5OCIgeT0iMTIwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2NiZDVlMSI+cHJpdmF0ZSBrZXk8L3RleHQ+Cjx0ZXh0IHg9IjI5OCIgeT0iMTM1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4Ij5uZXZlciByZXR1cm5lZCBieSBHZXRDZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iMjA5IiB5PSIxNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij50aGUga2V5IGlzIG5ldmVyIHJldHJpZXZhYmxlPC90ZXh0Pgo8bGluZSB4MT0iNDE4IiB5MT0iNDAiIHgyPSI0MTgiIHkyPSIxNzgiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0ic3Ryb2tlOiM0NzU1NjkiLz4KPHJlY3QgeD0iNDM0IiB5PSIzNCIgd2lkdGg9IjM4NiIgaGVpZ2h0PSIxNTAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiM0MjIwMDY7c3Ryb2tlOiNmYmJmMjQiLz4KPHRleHQgeD0iNDQ4IiB5PSI1NCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2ZiYmYyNCI+VEhFIFZBVUxUIENFUlRJRklDQVRFIMK3IGV4cG9ydGFibGUgPSB0cnVlPC90ZXh0Pgo8cmVjdCB4PSI0NDgiIHk9IjcyIiB3aWR0aD0iMTIwIiBoZWlnaHQ9IjU2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojOTI0MDBlIi8+Cjx0ZXh0IHg9IjUwOCIgeT0iOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTAuNXB4O2ZpbGw6I2E1YjRmYyI+dmF1bHQgY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjUwOCIgeT0iMTEzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+a2V5X3Byb3BlcnRpZXM8L3RleHQ+CjxsaW5lIHgxPSI1NjgiIHkxPSIxMDAiIHgyPSI1OTAiIHkyPSIxMDAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNhY21rdjVhKSIgc3R5bGU9InN0cm9rZTojZmJiZjI0Ii8+CjxyZWN0IHg9IjU5NCIgeT0iNzIiIHdpZHRoPSIyMTIiIGhlaWdodD0iNzQiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM5MjQwMGUiLz4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoNjA4LDg4KSBzY2FsZSgxLjApIj48cGF0aCBkPSJNNCA4IFY2IGE1IDUgMCAwIDEgOS42IC0xLjkiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0ic3Ryb2tlOiNmYmJmMjQiLz48cmVjdCB4PSIyIiB5PSI4IiB3aWR0aD0iMTQiIGhlaWdodD0iMTEiIHJ4PSIyLjIiIHN0eWxlPSJmaWxsOiNmYmJmMjQiLz48Y2lyY2xlIGN4PSI5IiBjeT0iMTIuNSIgcj0iMS43IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PHJlY3QgeD0iOC4yIiB5PSIxMyIgd2lkdGg9IjEuNiIgaGVpZ2h0PSIzLjYiIHJ4PSIwLjgiIHN0eWxlPSJmaWxsOiMxZTI5M2IiLz48L2c+Cjx0ZXh0IHg9IjcxMiIgeT0iOTQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMHB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojZmJiZjI0Ij5wcml2YXRlIGtleSDCtyByZWFkYWJsZTwvdGV4dD4KPHRleHQgeD0iNzAwIiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6I2ZiYmYyNCI+cmV0cmlldmFibGUgdGhyb3VnaCB0aGU8L3RleHQ+Cjx0ZXh0IHg9IjcwMCIgeT0iMTI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiNmYmJmMjQiPmJhY2tpbmcgS2V5IFZhdWx0IHNlY3JldDwvdGV4dD4KPHRleHQgeD0iNjI3IiB5PSIxNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6I2ZiYmYyNCI+TGltaXQgd2hvIGNhbiByZWFkIHRoZSBiYWNraW5nIHNlY3JldDwvdGV4dD4KPC9zdmc+)

The Key Vault certificate is exportable: anyone who can read its backing secret can read the private key.

#### Renewal

Key Vault renews a certificate according to the `lifetime_action` in its policy (`AutoRenew` at `days_before_expiry` or `lifetime_percentage`). The policy Tensor9 generates does not set a lifetime action of its own, so check the certificate's renewal setting in Key Vault after installation. The certificate is valid for 12 months.

Each renewal creates a new certificate and secret version. The TLS endpoint must use a versionless secret reference, or you must update its versioned reference, to pick up the renewed certificate. Self-signed certificates (`issuer = Self`) and certificates from integrated partner CAs can renew automatically. Imported certificates (`issuer = Unknown`) cannot: you obtain and import a replacement before expiry.

![When Key Vault renews a certificate it creates a new version. A versionless secret reference lets the TLS endpoint pick up the new version. Self-signed and partner-CA certificates can renew automatically; imported ones cannot.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJXaGVuIEtleSBWYXVsdCByZW5ld3MgYSBjZXJ0aWZpY2F0ZSBpdCBjcmVhdGVzIGEgbmV3IHZlcnNpb24uIEEgdmVyc2lvbmxlc3Mgc2VjcmV0IHJlZmVyZW5jZSBsZXRzIHRoZSBUTFMgZW5kcG9pbnQgcGljayB1cCB0aGUgbmV3IHZlcnNpb24uIFNlbGYtc2lnbmVkIGFuZCBwYXJ0bmVyLUNBIGNlcnRpZmljYXRlcyBjYW4gcmVuZXcgYXV0b21hdGljYWxseTsgaW1wb3J0ZWQgb25lcyBjYW5ub3QuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImFjbWt2NiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PG1hcmtlciBpZD0iYWNta3Y2ZyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPlJFTkVXQUwgQ1JFQVRFUyBBIE5FVyBWRVJTSU9OIMK3IFVTRSBBIFZFUlNJT05MRVNTIFJFRkVSRU5DRTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjQyIiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjU4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDQwLDU0KSI+PHJlY3QgeD0iMCIgeT0iMCIgd2lkdGg9IjE3IiBoZWlnaHQ9IjIxIiByeD0iMiIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiMzMzQxNTUiLz48bGluZSB4MT0iNCIgeTE9IjYiIHgyPSIxMyIgeTI9IjYiIHN0cm9rZS13aWR0aD0iMS4zIiBvcGFjaXR5PSIuNSIgc3R5bGU9InN0cm9rZTojMzM0MTU1Ii8+PGxpbmUgeDE9IjQiIHkxPSI5LjUiIHgyPSIxMyIgeTI9IjkuNSIgc3Ryb2tlLXdpZHRoPSIxLjMiIG9wYWNpdHk9Ii41IiBzdHlsZT0ic3Ryb2tlOiMzMzQxNTUiLz48bGluZSB4MT0iNCIgeTE9IjEzIiB4Mj0iOS41IiB5Mj0iMTMiIHN0cm9rZS13aWR0aD0iMS4zIiBvcGFjaXR5PSIuNSIgc3R5bGU9InN0cm9rZTojMzM0MTU1Ii8+PGNpcmNsZSBjeD0iMTMuNSIgY3k9IjE2LjUiIHI9IjQuNCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiMzMzQxNTUiLz48cGF0aCBkPSJNMTEgMjAgbC0xLjQgNC40IGwzLjkgLTIuMSBsMy45IDIuMSBsLTEuNCAtNC40IiBzdHJva2Utd2lkdGg9IjEuMiIgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6IzMzNDE1NSIvPjxjaXJjbGUgY3g9IjEzLjUiIGN5PSIxNi41IiByPSIxLjUiIHN0eWxlPSJmaWxsOiMzMzQxNTUiLz48L2c+Cjx0ZXh0IHg9IjExMiIgeT0iNjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTFweCI+aXNzdWVkIGNlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSIxMTIiIHk9Ijg0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij5hdHRhY2hlZCwgaW4gdXNlPC90ZXh0Pgo8bGluZSB4MT0iMTc0IiB5MT0iNzEiIHgyPSIyMTAiIHkyPSI3MSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2FjbWt2NikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8Y2lyY2xlIGN4PSIyMzgiIGN5PSI3MSIgcj0iMjIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+CjxjaXJjbGUgY3g9IjIzOCIgY3k9IjcxIiByPSIxNyIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0ic3Ryb2tlOiNjYmQ1ZTEiLz4KPGxpbmUgeDE9IjIzOCIgeTE9IjcxIiB4Mj0iMjM4IiB5Mj0iNTgiIHN0cm9rZS13aWR0aD0iMS42IiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8bGluZSB4MT0iMjM4IiB5MT0iNzEiIHgyPSIyNDciIHkyPSI3NiIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0cm9rZS1saW5lY2FwPSJyb3VuZCIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjIzOCIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjhweCI+YmVmb3JlIGV4cGlyeTwvdGV4dD4KPGxpbmUgeDE9IjI2NiIgeTE9IjcxIiB4Mj0iMzAyIiB5Mj0iNzEiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNhY21rdjZnKSIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjI4NCIgeT0iNjMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6Ny41cHg7ZmlsbDojMDQ3ODU3Ij5hdXRvPC90ZXh0Pgo8cmVjdCB4PSIzMDQiIHk9IjQyIiB3aWR0aD0iMTY4IiBoZWlnaHQ9IjU4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDMyMCw1NCkiPjxyZWN0IHg9IjAiIHk9IjAiIHdpZHRoPSIxNyIgaGVpZ2h0PSIyMSIgcng9IjIiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojMDQ3ODU3Ii8+PGxpbmUgeDE9IjQiIHkxPSI2IiB4Mj0iMTMiIHkyPSI2IiBzdHJva2Utd2lkdGg9IjEuMyIgb3BhY2l0eT0iLjUiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPjxsaW5lIHgxPSI0IiB5MT0iOS41IiB4Mj0iMTMiIHkyPSI5LjUiIHN0cm9rZS13aWR0aD0iMS4zIiBvcGFjaXR5PSIuNSIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+PGxpbmUgeDE9IjQiIHkxPSIxMyIgeDI9IjkuNSIgeTI9IjEzIiBzdHJva2Utd2lkdGg9IjEuMyIgb3BhY2l0eT0iLjUiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPjxjaXJjbGUgY3g9IjEzLjUiIGN5PSIxNi41IiByPSI0LjQiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojMDQ3ODU3Ii8+PHBhdGggZD0iTTExIDIwIGwtMS40IDQuNCBsMy45IC0yLjEgbDMuOSAyLjEgbC0xLjQgLTQuNCIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiMwNDc4NTciLz48Y2lyY2xlIGN4PSIxMy41IiBjeT0iMTYuNSIgcj0iMS41IiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PC9nPgo8dGV4dCB4PSI0MDQiIHk9IjY0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjExcHgiPnJlbmV3ZWQgY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjQwNCIgeT0iODAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZTo5LjVweCI+bmV3IGNlcnRpZmljYXRlIHZlcnNpb248L3RleHQ+CjxsaW5lIHgxPSI0NzIiIHkxPSI3MSIgeDI9IjUwMCIgeTI9IjcxIiBzdHJva2Utd2lkdGg9IjEuNiIgc3Ryb2tlLWRhc2hhcnJheT0iNCAzIiBtYXJrZXItZW5kPSJ1cmwoI2FjbWt2NikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI1MDIiIHk9IjUwIiB3aWR0aD0iMzEwIiBoZWlnaHQ9IjQyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjY1NyIgeT0iNjkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlO2ZpbGw6IzMzNDE1NSI+VXNlIGEgdmVyc2lvbmxlc3Mgc2VjcmV0IHJlZmVyZW5jZTwvdGV4dD4KPHRleHQgeD0iNjU3IiB5PSI4NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPnRoZSBjb25zdW1lciBrZWVwcyBwb2ludGluZyBhdCB0aGUgc2FtZSBjZXJ0aWZpY2F0ZTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjEyMCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSI0MCIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6I2ZmZmJlYjtzdHJva2U6I2ZkZTY4YSIvPgo8dGV4dCB4PSI0MCIgeT0iMTQ1IiBzdHlsZT0iZm9udDo3MDAgMTBweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2I0NTMwOSI+UmVuZXdhbCBsaW1pdHM8L3RleHQ+Cjx0ZXh0IHg9IjE1MCIgeT0iMTQ1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojYjQ1MzA5Ij5zZWxmLXNpZ25lZCAoaXNzdWVyIFNlbGYpIGFuZCBwYXJ0bmVyLUNBIGNlcnRpZmljYXRlcyBjYW4gcmVuZXcgYXV0b21hdGljYWxseTsgaW1wb3J0ZWQgY2VydGlmaWNhdGVzIChpc3N1ZXIgVW5rbm93bikgY2Fubm90LjwvdGV4dD4KPC9zdmc+)

![When Key Vault renews a certificate it creates a new version. A versionless secret reference lets the TLS endpoint pick up the new version. Self-signed and partner-CA certificates can renew automatically; imported ones cannot.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTc2IiB2aWV3Qm94PSIwIDAgODM2IDE3NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJXaGVuIEtleSBWYXVsdCByZW5ld3MgYSBjZXJ0aWZpY2F0ZSBpdCBjcmVhdGVzIGEgbmV3IHZlcnNpb24uIEEgdmVyc2lvbmxlc3Mgc2VjcmV0IHJlZmVyZW5jZSBsZXRzIHRoZSBUTFMgZW5kcG9pbnQgcGljayB1cCB0aGUgbmV3IHZlcnNpb24uIFNlbGYtc2lnbmVkIGFuZCBwYXJ0bmVyLUNBIGNlcnRpZmljYXRlcyBjYW4gcmVuZXcgYXV0b21hdGljYWxseTsgaW1wb3J0ZWQgb25lcyBjYW5ub3QuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImFjbWt2NiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PG1hcmtlciBpZD0iYWNta3Y2ZyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPlJFTkVXQUwgQ1JFQVRFUyBBIE5FVyBWRVJTSU9OIMK3IFVTRSBBIFZFUlNJT05MRVNTIFJFRkVSRU5DRTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjQyIiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjU4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDQwLDU0KSI+PHJlY3QgeD0iMCIgeT0iMCIgd2lkdGg9IjE3IiBoZWlnaHQ9IjIxIiByeD0iMiIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiNjYmQ1ZTEiLz48bGluZSB4MT0iNCIgeTE9IjYiIHgyPSIxMyIgeTI9IjYiIHN0cm9rZS13aWR0aD0iMS4zIiBvcGFjaXR5PSIuNSIgc3R5bGU9InN0cm9rZTojY2JkNWUxIi8+PGxpbmUgeDE9IjQiIHkxPSI5LjUiIHgyPSIxMyIgeTI9IjkuNSIgc3Ryb2tlLXdpZHRoPSIxLjMiIG9wYWNpdHk9Ii41IiBzdHlsZT0ic3Ryb2tlOiNjYmQ1ZTEiLz48bGluZSB4MT0iNCIgeTE9IjEzIiB4Mj0iOS41IiB5Mj0iMTMiIHN0cm9rZS13aWR0aD0iMS4zIiBvcGFjaXR5PSIuNSIgc3R5bGU9InN0cm9rZTojY2JkNWUxIi8+PGNpcmNsZSBjeD0iMTMuNSIgY3k9IjE2LjUiIHI9IjQuNCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiNjYmQ1ZTEiLz48cGF0aCBkPSJNMTEgMjAgbC0xLjQgNC40IGwzLjkgLTIuMSBsMy45IDIuMSBsLTEuNCAtNC40IiBzdHJva2Utd2lkdGg9IjEuMiIgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6I2NiZDVlMSIvPjxjaXJjbGUgY3g9IjEzLjUiIGN5PSIxNi41IiByPSIxLjUiIHN0eWxlPSJmaWxsOiNjYmQ1ZTEiLz48L2c+Cjx0ZXh0IHg9IjExMiIgeT0iNjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTFweCI+aXNzdWVkIGNlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSIxMTIiIHk9Ijg0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij5hdHRhY2hlZCwgaW4gdXNlPC90ZXh0Pgo8bGluZSB4MT0iMTc0IiB5MT0iNzEiIHgyPSIyMTAiIHkyPSI3MSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2FjbWt2NikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8Y2lyY2xlIGN4PSIyMzgiIGN5PSI3MSIgcj0iMjIiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+CjxjaXJjbGUgY3g9IjIzOCIgY3k9IjcxIiByPSIxNyIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0ic3Ryb2tlOiM0NzU1NjkiLz4KPGxpbmUgeDE9IjIzOCIgeTE9IjcxIiB4Mj0iMjM4IiB5Mj0iNTgiIHN0cm9rZS13aWR0aD0iMS42IiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8bGluZSB4MT0iMjM4IiB5MT0iNzEiIHgyPSIyNDciIHkyPSI3NiIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0cm9rZS1saW5lY2FwPSJyb3VuZCIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjIzOCIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjhweCI+YmVmb3JlIGV4cGlyeTwvdGV4dD4KPGxpbmUgeDE9IjI2NiIgeTE9IjcxIiB4Mj0iMzAyIiB5Mj0iNzEiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNhY21rdjZnKSIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjI4NCIgeT0iNjMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6Ny41cHg7ZmlsbDojNmVlN2I3Ij5hdXRvPC90ZXh0Pgo8cmVjdCB4PSIzMDQiIHk9IjQyIiB3aWR0aD0iMTY4IiBoZWlnaHQ9IjU4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDMyMCw1NCkiPjxyZWN0IHg9IjAiIHk9IjAiIHdpZHRoPSIxNyIgaGVpZ2h0PSIyMSIgcng9IjIiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNmVlN2I3Ii8+PGxpbmUgeDE9IjQiIHkxPSI2IiB4Mj0iMTMiIHkyPSI2IiBzdHJva2Utd2lkdGg9IjEuMyIgb3BhY2l0eT0iLjUiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPjxsaW5lIHgxPSI0IiB5MT0iOS41IiB4Mj0iMTMiIHkyPSI5LjUiIHN0cm9rZS13aWR0aD0iMS4zIiBvcGFjaXR5PSIuNSIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+PGxpbmUgeDE9IjQiIHkxPSIxMyIgeDI9IjkuNSIgeTI9IjEzIiBzdHJva2Utd2lkdGg9IjEuMyIgb3BhY2l0eT0iLjUiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPjxjaXJjbGUgY3g9IjEzLjUiIGN5PSIxNi41IiByPSI0LjQiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNmVlN2I3Ii8+PHBhdGggZD0iTTExIDIwIGwtMS40IDQuNCBsMy45IC0yLjEgbDMuOSAyLjEgbC0xLjQgLTQuNCIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM2ZWU3YjciLz48Y2lyY2xlIGN4PSIxMy41IiBjeT0iMTYuNSIgcj0iMS41IiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PC9nPgo8dGV4dCB4PSI0MDQiIHk9IjY0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjExcHgiPnJlbmV3ZWQgY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjQwNCIgeT0iODAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZTo5LjVweCI+bmV3IGNlcnRpZmljYXRlIHZlcnNpb248L3RleHQ+CjxsaW5lIHgxPSI0NzIiIHkxPSI3MSIgeDI9IjUwMCIgeTI9IjcxIiBzdHJva2Utd2lkdGg9IjEuNiIgc3Ryb2tlLWRhc2hhcnJheT0iNCAzIiBtYXJrZXItZW5kPSJ1cmwoI2FjbWt2NikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI1MDIiIHk9IjUwIiB3aWR0aD0iMzEwIiBoZWlnaHQ9IjQyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjY1NyIgeT0iNjkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlO2ZpbGw6I2NiZDVlMSI+VXNlIGEgdmVyc2lvbmxlc3Mgc2VjcmV0IHJlZmVyZW5jZTwvdGV4dD4KPHRleHQgeD0iNjU3IiB5PSI4NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPnRoZSBjb25zdW1lciBrZWVwcyBwb2ludGluZyBhdCB0aGUgc2FtZSBjZXJ0aWZpY2F0ZTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjEyMCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSI0MCIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6IzQyMjAwNjtzdHJva2U6IzkyNDAwZSIvPgo8dGV4dCB4PSI0MCIgeT0iMTQ1IiBzdHlsZT0iZm9udDo3MDAgMTBweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2ZiYmYyNCI+UmVuZXdhbCBsaW1pdHM8L3RleHQ+Cjx0ZXh0IHg9IjE1MCIgeT0iMTQ1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojZmJiZjI0Ij5zZWxmLXNpZ25lZCAoaXNzdWVyIFNlbGYpIGFuZCBwYXJ0bmVyLUNBIGNlcnRpZmljYXRlcyBjYW4gcmVuZXcgYXV0b21hdGljYWxseTsgaW1wb3J0ZWQgY2VydGlmaWNhdGVzIChpc3N1ZXIgVW5rbm93bikgY2Fubm90LjwvdGV4dD4KPC9zdmc+)

Renewal creates a new version. A versionless secret reference lets the TLS endpoint follow it.

#### Limitations

Where Key Vault certificates and ACM differ

* **Certificates are not publicly trusted.** Tensor9 generates a self-signed certificate (issuer Self), so browsers and other clients reject it until you distribute its root. Public trust needs a Key Vault partner CA or an App Service Managed Certificate, which you set up.
* **ACM domain validation is not supported.** Key Vault issues from the certificate policy, so DNS, email and CloudFront HTTP validation are not reproduced. A certificate with `validation_method` `EMAIL` or `HTTP` stops the build with an error; use DNS validation.
* **Only RSA 2048 keys are supported.** Every generated key is RSA 2048. A certificate whose `key_algorithm` is anything else, such as `EC_prime256v1` or `RSA_4096`, stops the build with an error.
* **The private key behaves differently: it can be read.** The generated key is exportable through the backing Key Vault secret, while ACM never returns a default certificate's key. Restrict who can read that secret.
* **Private CA certificates are not supported.** A certificate that sets `certificate_authority_arn` stops the build with an error, because a self-signed Key Vault certificate would not keep the private CA's trust. Use a public ACM certificate.
* **Exportable ACM certificates are not supported.** A certificate with `options.export = ENABLED` stops the build with an error, because Tensor9 would create a new key rather than keep the existing one.
* **Subject alternative names from variables behave differently.** Names Tensor9 cannot read when it builds the deployment (variables or expressions) are left off the certificate, and the build reports a warning. The certificate then covers the primary domain only.
* **You must declare certificates as resources in the root module.** A `data "aws_acm_certificate"` lookup, or a certificate declared in a child module, stops the build with an error.

#### Other considerations

* **Permissions.** Tensor9 grants the Cloud Adapter deployment identity the Key Vault Certificates Officer role on the shared vault so it can create certificates. The gateway or App Service that handles TLS needs read access to the backing secret under its own Azure identity. Grant only the vault or object scope it needs.
* **Before switching traffic.** Distribute the certificate's root to your clients, confirm they accept it, and confirm the TLS endpoint can read the certificate. Check the renewal setting, and use a versionless secret reference where the endpoint supports one.
* **Recovery and name reuse.** Key Vault soft-delete keeps a deleted certificate for its retention period, which affects recovery and reusing the same name.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### AWS ACM public certificates · Active public certificates

Feature: AWS ACM public certificates.

Estimated monthly service charges by Active public certificates. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/905b4b5cb7d9aef0a25e5e6cb8e6e9df545f36b3221c33d2f5ed03440ea32a72-light.svg)

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/750155f3fb45a5bc44bf0c823c00a9f1ad904cb5ec6f10fcadc41d155499c502-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Active public certificates (certificates) | ACM Certificate | Target scenario | Key Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | Key Vault (one staging copy) | 118.18 | 118.18 |
| 0 | 0.00 | Key Vault (two staging copies) | 236.36 | 236.36 |
| 10 | 0.00 | Key Vault (one staging copy) | 118.18 | 118.18 |
| 10 | 0.00 | Key Vault (two staging copies) | 236.36 | 236.36 |
| 100 | 0.00 | Key Vault (one staging copy) | 118.18 | 118.18 |
| 100 | 0.00 | Key Vault (two staging copies) | 236.36 | 236.36 |
| 1,000 | 0.00 | Key Vault (one staging copy) | 118.18 | 118.18 |
| 1,000 | 0.00 | Key Vault (two staging copies) | 236.36 | 236.36 |
| 10,000 | 0.00 | Key Vault (one staging copy) | 118.18 | 118.18 |
| 10,000 | 0.00 | Key Vault (two staging copies) | 236.36 | 236.36 |
| 100,000 | 0.00 | Key Vault (one staging copy) | 118.18 | 118.18 |
| 100,000 | 0.00 | Key Vault (two staging copies) | 236.36 | 236.36 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Key Vault (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Key Vault (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Key Vault (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| Key Vault (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| Key Vault (one staging copy) | Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| Key Vault (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| Key Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| Key Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| Key Vault (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Key Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Key Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| Key Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Key Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Key Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| Key Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| Key Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Key Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Key Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Key Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Key Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Key Vault (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Key Vault (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Key Vault (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| Key Vault (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| Key Vault (two staging copies) | Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| Key Vault (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| Key Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| Key Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| Key Vault (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Key Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Key Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| Key Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Key Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Key Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| Key Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| Key Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Key Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Key Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Key Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Key Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source price. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* Certificate operations bill as vault operations; a certificate renewal request through an integrated CA lists USD 3 and is not modeled. ACME DNS challenges, hosting and durable state require separate allocation.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-21c50979198015a1fe8b833ea00c654bdcb9a531` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

##### AWS ACM public certificates · Certificate issuances and renewals

Feature: AWS ACM public certificates.

Estimated monthly service charges by Certificate issuances and renewals. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/73e530227a5af11d5f4dbbd4984283ffb6e970b99fb47e749d31199263890968-light.svg)

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/f353460e7111696e673e54b1b4225db6e035dba893ed43efab20b3b335895ef5-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Certificate issuances and renewals (issuances/month) | ACM Certificate | Target scenario | Key Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | Key Vault (one staging copy) | 118.18 | 118.18 |
| 0 | 0.00 | Key Vault (two staging copies) | 236.36 | 236.36 |
| 10 | 0.00 | Key Vault (one staging copy) | 118.18 | 118.18 |
| 10 | 0.00 | Key Vault (two staging copies) | 236.36 | 236.36 |
| 100 | 0.00 | Key Vault (one staging copy) | 118.18 | 118.18 |
| 100 | 0.00 | Key Vault (two staging copies) | 236.36 | 236.36 |
| 1,000 | 0.00 | Key Vault (one staging copy) | 118.24 | 118.24 |
| 1,000 | 0.00 | Key Vault (two staging copies) | 236.42 | 236.42 |
| 10,000 | 0.00 | Key Vault (one staging copy) | 118.84 | 118.84 |
| 10,000 | 0.00 | Key Vault (two staging copies) | 237.02 | 237.02 |
| 100,000 | 0.00 | Key Vault (one staging copy) | 124.78 | 124.78 |
| 100,000 | 0.00 | Key Vault (two staging copies) | 242.96 | 242.96 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Key Vault (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Key Vault (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Key Vault (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| Key Vault (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| Key Vault (one staging copy) | Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| Key Vault (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| Key Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| Key Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| Key Vault (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Key Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Key Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| Key Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Key Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Key Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| Key Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| Key Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Key Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Key Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Key Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Key Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Key Vault (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Key Vault (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Key Vault (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| Key Vault (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| Key Vault (two staging copies) | Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| Key Vault (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| Key Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| Key Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| Key Vault (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Key Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Key Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| Key Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Key Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Key Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| Key Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| Key Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Key Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Key Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Key Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Key Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory remains at its authored default; issuance and renewal traffic varies independently. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source price. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* Certificate operations bill as vault operations; a certificate renewal request through an integrated CA lists USD 3 and is not modeled. ACME DNS challenges, hosting and durable state require separate allocation.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-21c50979198015a1fe8b833ea00c654bdcb9a531` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

**AWS ACM public certificates → Key Vault: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: eastus. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: Public non-exportable certificate inventory | 0.00 |
| Origin: Certificate issues and renewals | 0.00 |
| Origin: Certificate management reads | 0.00 |
| Target: Target retained physical data | 0.00 |
| Target: Additional broker replica storage | 0.00 |
| Target: Target native provider operations | 0.00 |
| Target: Execution or worker CPU | 0.00 |
| Target: Execution or worker RAM | 0.00 |
| Target: Selected billable network | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Durable staging CPU | 60.30 |
| Target: Durable staging RAM | 40.88 |
| Target: Durable staging disk | 17.00 |
| **Origin service subtotal** | **0.00** |
| **Target service subtotal** | **118.18** |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Origin list price · Certificate management reads | 0 | USD/requests |
| Provider operations per issuance | 20 | operations/issuance |
| Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| Issuance retry multiplier | 1.1 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target list price · provider operation | 0.000003 | USD/provider operation |
| Target price guess · GiB-month | 0 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target price guess · network GiB | 0 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| Public non-exportable certificate inventory | 100 | certificate-month |
| Certificate issues and renewals | 33 | issuances |
| Certificate management reads | 10,000 | requests |

* Translated reads: 10,000 operations.

* Translated writes: 33 operations.

* Translated resident physical data: under 0.01 GiB-month.

* Native provider operations: 726 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 0 vCPU-hour.

* Allocated execution RAM: 0 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 100 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.

* Public non-exportable source certificates have a zero authored source price. Exportable certificates and private-CA certificates require different models.

* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.

* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.

* Certificate operations bill as vault operations; a certificate renewal request through an integrated CA lists USD 3 and is not modeled. ACME DNS challenges, hosting and durable state require separate allocation.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-21c50979198015a1fe8b833ea00c654bdcb9a531` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

## On Google Cloud

### Certificate Manager

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| DescribeCertificate | Describe | Supported | Common | returns the certificate's identity and its DNS validation record, realized at install time over the Google-managed certificate |
| ListCertificates | Describe | Supported | Most usage | lists the installed certificates, known at install time |
| ImportCertificate | Issue | Supported | Most usage | a third-party certificate and its chain are provisioned onto a self-managed certificate; the imported private key is write-only and is never returned on read |
| RequestCertificate | Issue | Supported | Common | provisions the requested domain, its subject alternative names, and DNS validation onto a Google-managed certificate: publicly trusted, auto-renewed, its key algorithm Google-chosen (a managed certificate takes no algorithm argument) |
| DeleteCertificate | Lifecycle | Supported | Most usage | the managed certificate resource is removed and its consumer's attach reference rewritten so nothing dangles |
| UpdateCertificateOptions | Lifecycle | Out of scope | Full surface | certificate-option updates are outside this mapping; ACM has deprecated transparency-logging opt-out for public certificates |
| RenewCertificate | Renew | Supported | Most usage | Google renews the managed certificate before expiry |
| ExportCertificate | Retrieve | Out of scope | Most usage | a Google-managed key is never accessible and an imported key is write-only, so ExportCertificate is rejected; ACM opt-in managed-key export is not reproduced |
| GetCertificate | Retrieve | Supported | Common | returns the certificate and its chain, never the private key |
| AddTagsToCertificate | Tags | Supported | Full surface | tags become labels, lowercased to the label character set |
| RemoveTagsFromCertificate | Tags | Supported | Full surface | removes labels |
| DNS validation | Validate | Supported | Common | a DNS authorization publishes the same kind of CNAME record you add to your zone, and authorizing a domain also covers its wildcard: domain validation through DNS |
| Email / HTTP validation | Validate | Out of scope | Most usage | this mapping uses DNS authorization and does not translate ACM email or HTTP validation; Google also supports load-balancer authorization, which is outside this mapping |

#### How it works

On AWS, ACM issues and renews the certificate, and a load balancer, CDN or API gateway uses it by ARN. By default, ACM does not expose the private key. On Google Cloud, Tensor9 creates one Google-managed certificate for each `aws_acm_certificate` during installation and points the HTTPS load balancer or proxy at it. Google issues and renews the certificate and never exposes its key. Tensor9 is not in the path of your application's requests.

The ACM operation names on this card describe infrastructure equivalents configured during installation. This mapping does not serve runtime AWS ACM API requests. Certificate issuance, retrieval, renewal, and deletion use the backend service and its access controls.

![On AWS, ACM validates and issues the certificate and the load balancer uses it by ARN. On Google Cloud, Tensor9 creates a Google-managed certificate during installation and attaches it to your load balancer.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEwIiB2aWV3Qm94PSIwIDAgODM2IDIxMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEFDTSB2YWxpZGF0ZXMgYW5kIGlzc3VlcyB0aGUgY2VydGlmaWNhdGUgYW5kIHRoZSBsb2FkIGJhbGFuY2VyIHVzZXMgaXQgYnkgQVJOLiBPbiBHb29nbGUgQ2xvdWQsIFRlbnNvcjkgY3JlYXRlcyBhIEdvb2dsZS1tYW5hZ2VkIGNlcnRpZmljYXRlIGR1cmluZyBpbnN0YWxsYXRpb24gYW5kIGF0dGFjaGVzIGl0IHRvIHlvdXIgbG9hZCBiYWxhbmNlci4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2NtMSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PG1hcmtlciBpZD0iZ2NtMWciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzA0Nzg1NyIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQwIiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjE1MCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIyOCIgeT0iNzgiIHdpZHRoPSIxMDQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iODAiIHk9IjEwNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHgiPllvdXIgc3RhY2s8L3RleHQ+Cjx0ZXh0IHg9IjgwIiB5PSIxMjEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweCI+cmVxdWVzdCBhIGNlcnQ8L3RleHQ+CjxsaW5lIHgxPSIxMzIiIHkxPSIxMDgiIHgyPSIxNTAiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnY20xKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjE1MCIgeT0iNzgiIHdpZHRoPSIxMTgiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMjA5IiB5PSIxMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+QVdTIEFDTTwvdGV4dD4KPHRleHQgeD0iMjA5IiB5PSIxMTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPnZhbGlkYXRlIGRvbWFpbjwvdGV4dD4KPHRleHQgeD0iMjA5IiB5PSIxMjkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPmlzc3VlIGNlcnRpZmljYXRlPC90ZXh0Pgo8bGluZSB4MT0iMjY4IiB5MT0iMTA4IiB4Mj0iMjg2IiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2NtMSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyODYiIHk9Ijc4IiB3aWR0aD0iMTA0IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDMwMCw5MCkgc2NhbGUoMC43MikiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojMzM0MTU1Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojMzM0MTU1Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PC9nPgo8dGV4dCB4PSIzNTIiIHk9IjEwMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZTo5LjVweCI+QUxCIMK3IENsb3VkRnJvbnQ8L3RleHQ+Cjx0ZXh0IHg9IjMzOCIgeT0iMTIzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij50ZXJtaW5hdGVzIFRMUzwvdGV4dD4KPHRleHQgeD0iMjA4IiB5PSIxNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5kZWZhdWx0IEFDTSBrZXlzIHN0YXkgaW4gQVdTPC90ZXh0Pgo8bGluZSB4MT0iNDE4IiB5MT0iNDYiIHgyPSI0MTgiIHkyPSIxODQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0ic3Ryb2tlOiNjYmQ1ZTEiLz4KPHJlY3QgeD0iNDM2IiB5PSI0MCIgd2lkdGg9IjM4NCIgaGVpZ2h0PSIxNTAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NTAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PTiBUSEUgVEFSR0VUIENMT1VEIMK3IEdPT0dMRSBDTE9VRDwvdGV4dD4KPHJlY3QgeD0iNDQ4IiB5PSI3OCIgd2lkdGg9Ijk2IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ5NiIgeT0iMTA1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+WW91ciBzdGFjazwvdGV4dD4KPHRleHQgeD0iNDk2IiB5PSIxMjEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+dW5jaGFuZ2VkPC90ZXh0Pgo8bGluZSB4MT0iNTQ0IiB5MT0iMTA4IiB4Mj0iNTYwIiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2NtMSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI1NjAiIHk9Ijc0IiB3aWR0aD0iMTIyIiBoZWlnaHQ9IjY4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjYyMSIgeT0iOTkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+VGVuc29yOTwvdGV4dD4KPHRleHQgeD0iNjIxIiB5PSIxMTQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPmNyZWF0ZXMgdGhlIGNlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSI2MjEiIHk9IjEyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+ZHVyaW5nIGluc3RhbGxhdGlvbjwvdGV4dD4KPGxpbmUgeDE9IjY4MiIgeTE9IjEwOCIgeDI9IjY5OCIgeTI9IjEwOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2djbTFnKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjY5OCIgeT0iNzQiIHdpZHRoPSIxMDYiIGhlaWdodD0iNjgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiM0ZjQ2ZTUiLz4KPHRleHQgeD0iNzUxIiB5PSI5OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDEwLjVweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzRmNDZlNSI+Q2VydGlmaWNhdGUgTWdyPC90ZXh0Pgo8dGV4dCB4PSI3NTEiIHk9IjExNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPkdvb2dsZS1tYW5hZ2VkIGNlcnQ8L3RleHQ+Cjx0ZXh0IHg9Ijc1MSIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+b24geW91ciBsb2FkIGJhbGFuY2VyPC90ZXh0Pgo8dGV4dCB4PSI2MjgiIHk9IjE3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojMDQ3ODU3Ij50aGUgbG9hZCBiYWxhbmNlciBoYW5kbGVzIGFwcGxpY2F0aW9uIFRMUzwvdGV4dD4KPC9zdmc+)

![On AWS, ACM validates and issues the certificate and the load balancer uses it by ARN. On Google Cloud, Tensor9 creates a Google-managed certificate during installation and attaches it to your load balancer.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEwIiB2aWV3Qm94PSIwIDAgODM2IDIxMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEFDTSB2YWxpZGF0ZXMgYW5kIGlzc3VlcyB0aGUgY2VydGlmaWNhdGUgYW5kIHRoZSBsb2FkIGJhbGFuY2VyIHVzZXMgaXQgYnkgQVJOLiBPbiBHb29nbGUgQ2xvdWQsIFRlbnNvcjkgY3JlYXRlcyBhIEdvb2dsZS1tYW5hZ2VkIGNlcnRpZmljYXRlIGR1cmluZyBpbnN0YWxsYXRpb24gYW5kIGF0dGFjaGVzIGl0IHRvIHlvdXIgbG9hZCBiYWxhbmNlci4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2NtMSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PG1hcmtlciBpZD0iZ2NtMWciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzZlZTdiNyIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQwIiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjE1MCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIyOCIgeT0iNzgiIHdpZHRoPSIxMDQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iODAiIHk9IjEwNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHgiPllvdXIgc3RhY2s8L3RleHQ+Cjx0ZXh0IHg9IjgwIiB5PSIxMjEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweCI+cmVxdWVzdCBhIGNlcnQ8L3RleHQ+CjxsaW5lIHgxPSIxMzIiIHkxPSIxMDgiIHgyPSIxNTAiIHkyPSIxMDgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnY20xKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjE1MCIgeT0iNzgiIHdpZHRoPSIxMTgiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMjA5IiB5PSIxMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+QVdTIEFDTTwvdGV4dD4KPHRleHQgeD0iMjA5IiB5PSIxMTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPnZhbGlkYXRlIGRvbWFpbjwvdGV4dD4KPHRleHQgeD0iMjA5IiB5PSIxMjkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPmlzc3VlIGNlcnRpZmljYXRlPC90ZXh0Pgo8bGluZSB4MT0iMjY4IiB5MT0iMTA4IiB4Mj0iMjg2IiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2NtMSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyODYiIHk9Ijc4IiB3aWR0aD0iMTA0IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDMwMCw5MCkgc2NhbGUoMC43MikiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojY2JkNWUxIi8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojY2JkNWUxIi8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PC9nPgo8dGV4dCB4PSIzNTIiIHk9IjEwMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZTo5LjVweCI+QUxCIMK3IENsb3VkRnJvbnQ8L3RleHQ+Cjx0ZXh0IHg9IjMzOCIgeT0iMTIzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij50ZXJtaW5hdGVzIFRMUzwvdGV4dD4KPHRleHQgeD0iMjA4IiB5PSIxNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5kZWZhdWx0IEFDTSBrZXlzIHN0YXkgaW4gQVdTPC90ZXh0Pgo8bGluZSB4MT0iNDE4IiB5MT0iNDYiIHgyPSI0MTgiIHkyPSIxODQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0ic3Ryb2tlOiM0NzU1NjkiLz4KPHJlY3QgeD0iNDM2IiB5PSI0MCIgd2lkdGg9IjM4NCIgaGVpZ2h0PSIxNTAiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NTAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PTiBUSEUgVEFSR0VUIENMT1VEIMK3IEdPT0dMRSBDTE9VRDwvdGV4dD4KPHJlY3QgeD0iNDQ4IiB5PSI3OCIgd2lkdGg9Ijk2IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ5NiIgeT0iMTA1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+WW91ciBzdGFjazwvdGV4dD4KPHRleHQgeD0iNDk2IiB5PSIxMjEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+dW5jaGFuZ2VkPC90ZXh0Pgo8bGluZSB4MT0iNTQ0IiB5MT0iMTA4IiB4Mj0iNTYwIiB5Mj0iMTA4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2NtMSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI1NjAiIHk9Ijc0IiB3aWR0aD0iMTIyIiBoZWlnaHQ9IjY4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjYyMSIgeT0iOTkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+VGVuc29yOTwvdGV4dD4KPHRleHQgeD0iNjIxIiB5PSIxMTQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPmNyZWF0ZXMgdGhlIGNlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSI2MjEiIHk9IjEyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+ZHVyaW5nIGluc3RhbGxhdGlvbjwvdGV4dD4KPGxpbmUgeDE9IjY4MiIgeTE9IjEwOCIgeDI9IjY5OCIgeTI9IjEwOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2djbTFnKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjY5OCIgeT0iNzQiIHdpZHRoPSIxMDYiIGhlaWdodD0iNjgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiNhNWI0ZmMiLz4KPHRleHQgeD0iNzUxIiB5PSI5OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDEwLjVweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2E1YjRmYyI+Q2VydGlmaWNhdGUgTWdyPC90ZXh0Pgo8dGV4dCB4PSI3NTEiIHk9IjExNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPkdvb2dsZS1tYW5hZ2VkIGNlcnQ8L3RleHQ+Cjx0ZXh0IHg9Ijc1MSIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+b24geW91ciBsb2FkIGJhbGFuY2VyPC90ZXh0Pgo8dGV4dCB4PSI2MjgiIHk9IjE3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNmVlN2I3Ij50aGUgbG9hZCBiYWxhbmNlciBoYW5kbGVzIGFwcGxpY2F0aW9uIFRMUzwvdGV4dD4KPC9zdmc+)

Tensor9 creates a Google-managed certificate during installation and attaches it to your load balancer.

#### Managed and self-managed certificates

A `google_certificate_manager_certificate` is either `managed` or `self_managed`. Tensor9 creates a `managed` certificate whose `domains` are your `domain_name` and `subject_alternative_names`, with one `dns_authorizations` entry per domain. Google issues a publicly trusted certificate, chooses its key algorithm and renews it, as ACM does for `RequestCertificate`.

In `self_managed` mode, Google serves a certificate, chain and `pem_private_key` you supply, and you renew it. Tensor9 does not use this mode: an ACM certificate imported with `certificate_body` and `private_key` stops the build with an error.

![A Google certificate is either managed, issued and renewed by Google, or self-managed, a certificate you supply. Tensor9 creates managed certificates; it does not import certificates.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjU2IiB2aWV3Qm94PSIwIDAgODM2IDI1NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBIEdvb2dsZSBjZXJ0aWZpY2F0ZSBpcyBlaXRoZXIgbWFuYWdlZCwgaXNzdWVkIGFuZCByZW5ld2VkIGJ5IEdvb2dsZSwgb3Igc2VsZi1tYW5hZ2VkLCBhIGNlcnRpZmljYXRlIHlvdSBzdXBwbHkuIFRlbnNvcjkgY3JlYXRlcyBtYW5hZ2VkIGNlcnRpZmljYXRlczsgaXQgZG9lcyBub3QgaW1wb3J0IGNlcnRpZmljYXRlcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHRleHQgeD0iMjYiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMzM0MTU1Ij5BIEdPT0dMRSBDRVJUSUZJQ0FURSBJUyBFSVRIRVIgTUFOQUdFRCBPUiBTRUxGLU1BTkFHRUQ8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjM4NiIgaGVpZ2h0PSIyMDAiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiM0ZjQ2ZTUiLz4KPHRleHQgeD0iNDQiIHk9IjY4IiBzdHlsZT0iZm9udDo3MDAgMTNweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTtmaWxsOiM0ZjQ2ZTUiPm1hbmFnZWQgJiMxMjM7ICYjMTI1OzwvdGV4dD4KPHRleHQgeD0iNDQiIHk9Ijg2IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPkdvb2dsZSBpc3N1ZXMgaXQgYW5kIGF1dG8tcmVuZXdzIGl0IMK3IHB1YmxpY2x5IHRydXN0ZWQ8L3RleHQ+CjxsaW5lIHgxPSI0NCIgeTE9Ijk2IiB4Mj0iMzkwIiB5Mj0iOTYiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0ic3Ryb2tlOiNlZWYyZmYiLz4KPHRleHQgeD0iNDQiIHk9IjEyMCIgc3R5bGU9ImZvbnQ6MTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1Ij48dHNwYW4gc3R5bGU9ImZvbnQ6NjAwIDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7ZmlsbDojNGY0NmU1Ij5kb21haW5zPC90c3Bhbj4gIHRoZSBkb21haW4gYW5kIGl0cyBzdWJqZWN0IGFsdCBuYW1lczwvdGV4dD4KPHRleHQgeD0iNDQiIHk9IjE0NCIgc3R5bGU9ImZvbnQ6MTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1Ij48dHNwYW4gc3R5bGU9ImZvbnQ6NjAwIDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7ZmlsbDojNGY0NmU1Ij5kbnNfYXV0aG9yaXphdGlvbnM8L3RzcGFuPiAgRE5TLXZhbGlkYXRlZCBieSBDTkFNRTwvdGV4dD4KPHRleHQgeD0iNDQiIHk9IjE2OCIgc3R5bGU9ImZvbnQ6MTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1Ij50aGUga2V5IGlzIEdvb2dsZS1oZWxkLCBuZXZlciBhY2Nlc3NpYmxlPC90ZXh0Pgo8dGV4dCB4PSI0NCIgeT0iMTg4IiBzdHlsZT0iZm9udDoxMC41cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTUiPkdvb2dsZSBjaG9vc2VzIHRoZSBrZXkgYWxnb3JpdGhtPC90ZXh0Pgo8cmVjdCB4PSI0NCIgeT0iMjAyIiB3aWR0aD0iMjE0IiBoZWlnaHQ9IjIyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMSIgc3R5bGU9ImZpbGw6I2VlZjJmZjtzdHJva2U6I2M3ZDJmZSIvPgo8dGV4dCB4PSIxNTEiIHk9IjIxNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDkuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojNGY0NmU1Ij53aGF0IFRlbnNvcjkgY3JlYXRlczwvdGV4dD4KPHJlY3QgeD0iNDI2IiB5PSI0MCIgd2lkdGg9IjM4NiIgaGVpZ2h0PSIyMDAiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iNDQ2IiB5PSI2OCIgc3R5bGU9ImZvbnQ6NzAwIDEzcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7ZmlsbDojMzM0MTU1Ij5zZWxmX21hbmFnZWQgJiMxMjM7ICYjMTI1OzwvdGV4dD4KPHRleHQgeD0iNDQ2IiB5PSI4NiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4Ij55b3UgYnJpbmcgdGhlIGNlcnRpZmljYXRlIMK3IEdvb2dsZSBzZXJ2ZXMgaXQsIGRvZXMgbm90IGlzc3VlIGl0PC90ZXh0Pgo8bGluZSB4MT0iNDQ2IiB5MT0iOTYiIHgyPSI3OTIiIHkyPSI5NiIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJzdHJva2U6I2YxZjVmOSIvPgo8dGV4dCB4PSI0NDYiIHk9IjEyMCIgc3R5bGU9ImZvbnQ6MTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1Ij48dHNwYW4gc3R5bGU9ImZvbnQ6NjAwIDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7ZmlsbDojMzM0MTU1Ij5wZW1fY2VydGlmaWNhdGU8L3RzcGFuPiAgeW91ciBjZXJ0aWZpY2F0ZSBhbmQgY2hhaW48L3RleHQ+Cjx0ZXh0IHg9IjQ0NiIgeT0iMTQ0IiBzdHlsZT0iZm9udDoxMC41cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTUiPjx0c3BhbiBzdHlsZT0iZm9udDo2MDAgMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTtmaWxsOiMzMzQxNTUiPnBlbV9wcml2YXRlX2tleTwvdHNwYW4+ICB5b3VyIGtleSwgaW5wdXQtb25seTwvdGV4dD4KPHRleHQgeD0iNDQ2IiB5PSIxNjgiIHN0eWxlPSJmb250OjEwLjVweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NSI+bmV2ZXIgcmV0dXJuZWQgb24gcmVhZDwvdGV4dD4KPHRleHQgeD0iNDQ2IiB5PSIxODgiIHN0eWxlPSJmb250OjEwLjVweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NSI+dGhlIGtleSBhbGdvcml0aG0gaXMgeW91cnMgdG8gY2hvb3NlPC90ZXh0Pgo8cmVjdCB4PSI0NDYiIHk9IjIwMiIgd2lkdGg9IjIxMCIgaGVpZ2h0PSIyMiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNTUxIiB5PSIyMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCA5LjVweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NSI+bm90IHVzZWQgYnkgdGhpcyBtYXBwaW5nPC90ZXh0Pgo8Y2lyY2xlIGN4PSI0MTgiIGN5PSIxMzAiIHI9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0MTgiIHk9IjEzNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDEwcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiM2NDc0OGIiPm9yPC90ZXh0Pgo8L3N2Zz4=)

![A Google certificate is either managed, issued and renewed by Google, or self-managed, a certificate you supply. Tensor9 creates managed certificates; it does not import certificates.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjU2IiB2aWV3Qm94PSIwIDAgODM2IDI1NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBIEdvb2dsZSBjZXJ0aWZpY2F0ZSBpcyBlaXRoZXIgbWFuYWdlZCwgaXNzdWVkIGFuZCByZW5ld2VkIGJ5IEdvb2dsZSwgb3Igc2VsZi1tYW5hZ2VkLCBhIGNlcnRpZmljYXRlIHlvdSBzdXBwbHkuIFRlbnNvcjkgY3JlYXRlcyBtYW5hZ2VkIGNlcnRpZmljYXRlczsgaXQgZG9lcyBub3QgaW1wb3J0IGNlcnRpZmljYXRlcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHRleHQgeD0iMjYiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojY2JkNWUxIj5BIEdPT0dMRSBDRVJUSUZJQ0FURSBJUyBFSVRIRVIgTUFOQUdFRCBPUiBTRUxGLU1BTkFHRUQ8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjM4NiIgaGVpZ2h0PSIyMDAiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiNhNWI0ZmMiLz4KPHRleHQgeD0iNDQiIHk9IjY4IiBzdHlsZT0iZm9udDo3MDAgMTNweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTtmaWxsOiNhNWI0ZmMiPm1hbmFnZWQgJiMxMjM7ICYjMTI1OzwvdGV4dD4KPHRleHQgeD0iNDQiIHk9Ijg2IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPkdvb2dsZSBpc3N1ZXMgaXQgYW5kIGF1dG8tcmVuZXdzIGl0IMK3IHB1YmxpY2x5IHRydXN0ZWQ8L3RleHQ+CjxsaW5lIHgxPSI0NCIgeTE9Ijk2IiB4Mj0iMzkwIiB5Mj0iOTYiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0ic3Ryb2tlOiMxZTFiNGIiLz4KPHRleHQgeD0iNDQiIHk9IjEyMCIgc3R5bGU9ImZvbnQ6MTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxIj48dHNwYW4gc3R5bGU9ImZvbnQ6NjAwIDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7ZmlsbDojYTViNGZjIj5kb21haW5zPC90c3Bhbj4gIHRoZSBkb21haW4gYW5kIGl0cyBzdWJqZWN0IGFsdCBuYW1lczwvdGV4dD4KPHRleHQgeD0iNDQiIHk9IjE0NCIgc3R5bGU9ImZvbnQ6MTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxIj48dHNwYW4gc3R5bGU9ImZvbnQ6NjAwIDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7ZmlsbDojYTViNGZjIj5kbnNfYXV0aG9yaXphdGlvbnM8L3RzcGFuPiAgRE5TLXZhbGlkYXRlZCBieSBDTkFNRTwvdGV4dD4KPHRleHQgeD0iNDQiIHk9IjE2OCIgc3R5bGU9ImZvbnQ6MTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxIj50aGUga2V5IGlzIEdvb2dsZS1oZWxkLCBuZXZlciBhY2Nlc3NpYmxlPC90ZXh0Pgo8dGV4dCB4PSI0NCIgeT0iMTg4IiBzdHlsZT0iZm9udDoxMC41cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTEiPkdvb2dsZSBjaG9vc2VzIHRoZSBrZXkgYWxnb3JpdGhtPC90ZXh0Pgo8cmVjdCB4PSI0NCIgeT0iMjAyIiB3aWR0aD0iMjE0IiBoZWlnaHQ9IjIyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMSIgc3R5bGU9ImZpbGw6IzFlMWI0YjtzdHJva2U6IzM3MzBhMyIvPgo8dGV4dCB4PSIxNTEiIHk9IjIxNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDkuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYTViNGZjIj53aGF0IFRlbnNvcjkgY3JlYXRlczwvdGV4dD4KPHJlY3QgeD0iNDI2IiB5PSI0MCIgd2lkdGg9IjM4NiIgaGVpZ2h0PSIyMDAiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iNDQ2IiB5PSI2OCIgc3R5bGU9ImZvbnQ6NzAwIDEzcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7ZmlsbDojY2JkNWUxIj5zZWxmX21hbmFnZWQgJiMxMjM7ICYjMTI1OzwvdGV4dD4KPHRleHQgeD0iNDQ2IiB5PSI4NiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4Ij55b3UgYnJpbmcgdGhlIGNlcnRpZmljYXRlIMK3IEdvb2dsZSBzZXJ2ZXMgaXQsIGRvZXMgbm90IGlzc3VlIGl0PC90ZXh0Pgo8bGluZSB4MT0iNDQ2IiB5MT0iOTYiIHgyPSI3OTIiIHkyPSI5NiIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJzdHJva2U6IzFlMjkzYiIvPgo8dGV4dCB4PSI0NDYiIHk9IjEyMCIgc3R5bGU9ImZvbnQ6MTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxIj48dHNwYW4gc3R5bGU9ImZvbnQ6NjAwIDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7ZmlsbDojY2JkNWUxIj5wZW1fY2VydGlmaWNhdGU8L3RzcGFuPiAgeW91ciBjZXJ0aWZpY2F0ZSBhbmQgY2hhaW48L3RleHQ+Cjx0ZXh0IHg9IjQ0NiIgeT0iMTQ0IiBzdHlsZT0iZm9udDoxMC41cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTEiPjx0c3BhbiBzdHlsZT0iZm9udDo2MDAgMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTtmaWxsOiNjYmQ1ZTEiPnBlbV9wcml2YXRlX2tleTwvdHNwYW4+ICB5b3VyIGtleSwgaW5wdXQtb25seTwvdGV4dD4KPHRleHQgeD0iNDQ2IiB5PSIxNjgiIHN0eWxlPSJmb250OjEwLjVweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMSI+bmV2ZXIgcmV0dXJuZWQgb24gcmVhZDwvdGV4dD4KPHRleHQgeD0iNDQ2IiB5PSIxODgiIHN0eWxlPSJmb250OjEwLjVweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMSI+dGhlIGtleSBhbGdvcml0aG0gaXMgeW91cnMgdG8gY2hvb3NlPC90ZXh0Pgo8cmVjdCB4PSI0NDYiIHk9IjIwMiIgd2lkdGg9IjIxMCIgaGVpZ2h0PSIyMiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNTUxIiB5PSIyMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCA5LjVweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMSI+bm90IHVzZWQgYnkgdGhpcyBtYXBwaW5nPC90ZXh0Pgo8Y2lyY2xlIGN4PSI0MTgiIGN5PSIxMzAiIHI9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0MTgiIHk9IjEzNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDEwcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiM5NGEzYjgiPm9yPC90ZXh0Pgo8L3N2Zz4=)

Tensor9 creates managed certificates, which Google issues and renews.

#### DNS validation

For ACM DNS validation, `RequestCertificate` returns the certificate ARN. `DescribeCertificate` supplies its DNS validation CNAME while the certificate is `PENDING_VALIDATION`. Publishing that record proves domain control. ACM then marks the certificate `ISSUED` and uses the DNS authorization for subsequent renewal.

A `google_certificate_manager_dns_authorization` similarly returns a `dns_resource_record` CNAME to publish in your zone. Tensor9 creates one authorization per domain; one authorization covers a domain and its wildcard, such as `example.com` and `*.example.com`. If your stack wrote ACM's validation records to Route 53, Tensor9 writes Google's CNAME records to the matching Cloud DNS zone instead. A certificate with `validation_method` `EMAIL` or `HTTP` stops the build with an error; DNS is the supported method.

![On AWS, a CNAME record in your zone proves domain control before ACM issues the certificate. On Google Cloud, a DNS authorization produces its own CNAME record, which goes in the same zone. Only DNS validation is supported.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjg2IiB2aWV3Qm94PSIwIDAgODM2IDI4NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIGEgQ05BTUUgcmVjb3JkIGluIHlvdXIgem9uZSBwcm92ZXMgZG9tYWluIGNvbnRyb2wgYmVmb3JlIEFDTSBpc3N1ZXMgdGhlIGNlcnRpZmljYXRlLiBPbiBHb29nbGUgQ2xvdWQsIGEgRE5TIGF1dGhvcml6YXRpb24gcHJvZHVjZXMgaXRzIG93biBDTkFNRSByZWNvcmQsIHdoaWNoIGdvZXMgaW4gdGhlIHNhbWUgem9uZS4gT25seSBETlMgdmFsaWRhdGlvbiBpcyBzdXBwb3J0ZWQuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdjbTMiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImdjbTNnIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiMwNDc4NTciLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzMzNDE1NSI+QVdTIMK3IEEgQ05BTUUgSU4gWU9VUiBaT05FIFBST1ZFUyBDT05UUk9MLCBUSEVOIFRIRSBDRVJUSUZJQ0FURSBJU1NVRVM8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIzOCIgd2lkdGg9IjE3MCIgaGVpZ2h0PSI1MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIxMDkiIHk9IjYwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1O2ZvbnQtc2l6ZToxMC41cHgiPlJlcXVlc3QgKyBEZXNjcmliZTwvdGV4dD4KPHRleHQgeD0iMTA5IiB5PSI3NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPkROUyB2YWxpZGF0aW9uPC90ZXh0Pgo8bGluZSB4MT0iMTk0IiB5MT0iNjQiIHgyPSIyMTYiIHkyPSI2NCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2djbTMpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iMjE4IiB5PSIzNiIgd2lkdGg9IjI4OCIgaGVpZ2h0PSI1NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIyMzQiIHk9IjUyIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjhweDtmaWxsOiM2NDc0OGIiPkEgQ05BTUUgUkVDT1JEIElOIFlPVVIgWk9ORTwvdGV4dD4KPHRleHQgeD0iMjM0IiB5PSI2OCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiMzMzQxNTUiPl9hMWIyYzMuZXhhbXBsZS5jb20gIENOQU1FPC90ZXh0Pgo8dGV4dCB4PSIyMzQiIHk9IjgyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzMzNDE1NSI+4oaSIGFuIEFDTSB2YWxpZGF0aW9uIGhvc3Q8L3RleHQ+CjxsaW5lIHgxPSI1MDYiIHkxPSI2NCIgeDI9IjUyOCIgeTI9IjY0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2NtM2cpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHJlY3QgeD0iNTMwIiB5PSIzOCIgd2lkdGg9IjE1OCIgaGVpZ2h0PSI1MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI2MDkiIHk9IjYwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMDQ3ODU3O2ZvbnQtc2l6ZToxMnB4Ij5JU1NVRUQ8L3RleHQ+Cjx0ZXh0IHg9IjYwOSIgeT0iNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZTo5cHgiPnJlYWR5IHRvIGF0dGFjaDwvdGV4dD4KPHRleHQgeD0iMzYyIiB5PSIxMDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5wcm92ZSBjb250cm9sIMK3IHRoZSBwcm9vZiBsaXZlcyBpbiBETlMsIHNvIGl0IHN0YXlzIHZhbGlkIGZvciByZW5ld2FsPC90ZXh0Pgo8dGV4dCB4PSIyNiIgeT0iMTQwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PTiBHT09HTEUgwrcgQSBkbnNfYXV0aG9yaXphdGlvbiBQUk9EVUNFUyBJVFMgT1dOIFZBTElEQVRJT04gQ05BTUU8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxNTIiIHdpZHRoPSIzMzAiIGhlaWdodD0iNzIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDAiIHk9IjE3MiIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4cHg7ZmlsbDojNjQ3NDhiIj5BQ00gwrcgZG9tYWluX3ZhbGlkYXRpb25fb3B0aW9uczwvdGV4dD4KPHRleHQgeD0iNDAiIHk9IjE5MCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiMzMzQxNTUiPm5hbWUgICBfYTFiMmMzLmV4YW1wbGUuY29tPC90ZXh0Pgo8dGV4dCB4PSI0MCIgeT0iMjA2IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzMzNDE1NSI+dmFsdWUgIENOQU1FIOKGkiBhbiBBQ00gaG9zdDwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIxODQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAyMHB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojNGY0NmU1Ij7iiaE8L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMjAyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjhweCI+RE5TIHZhbGlkYXRpb248L3RleHQ+CjxyZWN0IHg9IjQ4MiIgeT0iMTUyIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjcyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojNGY0NmU1Ii8+Cjx0ZXh0IHg9IjQ5OCIgeT0iMTcyIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjhweDtmaWxsOiM0ZjQ2ZTUiPkdDUCDCtyBkbnNfYXV0aG9yaXphdGlvbi5kbnNfcmVzb3VyY2VfcmVjb3JkPC90ZXh0Pgo8dGV4dCB4PSI0OTgiIHk9IjE5MCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiMzMzQxNTUiPm5hbWUgICBfYTFiMmMzLmV4YW1wbGUuY29tPC90ZXh0Pgo8dGV4dCB4PSI0OTgiIHk9IjIwNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiMzMzQxNTUiPnZhbHVlICBDTkFNRSDihpIgYSBHb29nbGUgaG9zdDwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjIzMiIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSI0NiIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojZmZmYmViO3N0cm9rZTojZmRlNjhhIi8+Cjx0ZXh0IHg9IjQwIiB5PSIyNTEiIHN0eWxlPSJmb250OjcwMCAxMHB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYjQ1MzA5Ij5FTUFJTCBBTkQgSFRUUCBWQUxJREFUSU9OIEFSRSBOT1QgU1VQUE9SVEVEPC90ZXh0Pgo8dGV4dCB4PSI0MCIgeT0iMjY4IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojYjQ1MzA5Ij5UaGlzIG1hcHBpbmcgdXNlcyBETlMgYXV0aG9yaXphdGlvbi4gQSBjZXJ0aWZpY2F0ZSB1c2luZyBBQ00gZW1haWwgb3IgSFRUUCB2YWxpZGF0aW9uIHN0b3BzIHRoZSBidWlsZCB3aXRoIGFuIGVycm9yLjwvdGV4dD4KPC9zdmc+)

![On AWS, a CNAME record in your zone proves domain control before ACM issues the certificate. On Google Cloud, a DNS authorization produces its own CNAME record, which goes in the same zone. Only DNS validation is supported.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjg2IiB2aWV3Qm94PSIwIDAgODM2IDI4NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIGEgQ05BTUUgcmVjb3JkIGluIHlvdXIgem9uZSBwcm92ZXMgZG9tYWluIGNvbnRyb2wgYmVmb3JlIEFDTSBpc3N1ZXMgdGhlIGNlcnRpZmljYXRlLiBPbiBHb29nbGUgQ2xvdWQsIGEgRE5TIGF1dGhvcml6YXRpb24gcHJvZHVjZXMgaXRzIG93biBDTkFNRSByZWNvcmQsIHdoaWNoIGdvZXMgaW4gdGhlIHNhbWUgem9uZS4gT25seSBETlMgdmFsaWRhdGlvbiBpcyBzdXBwb3J0ZWQuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdjbTMiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImdjbTNnIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2ZWU3YjciLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2NiZDVlMSI+QVdTIMK3IEEgQ05BTUUgSU4gWU9VUiBaT05FIFBST1ZFUyBDT05UUk9MLCBUSEVOIFRIRSBDRVJUSUZJQ0FURSBJU1NVRVM8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIzOCIgd2lkdGg9IjE3MCIgaGVpZ2h0PSI1MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIxMDkiIHk9IjYwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxO2ZvbnQtc2l6ZToxMC41cHgiPlJlcXVlc3QgKyBEZXNjcmliZTwvdGV4dD4KPHRleHQgeD0iMTA5IiB5PSI3NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPkROUyB2YWxpZGF0aW9uPC90ZXh0Pgo8bGluZSB4MT0iMTk0IiB5MT0iNjQiIHgyPSIyMTYiIHkyPSI2NCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2djbTMpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iMjE4IiB5PSIzNiIgd2lkdGg9IjI4OCIgaGVpZ2h0PSI1NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIyMzQiIHk9IjUyIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjhweDtmaWxsOiM5NGEzYjgiPkEgQ05BTUUgUkVDT1JEIElOIFlPVVIgWk9ORTwvdGV4dD4KPHRleHQgeD0iMjM0IiB5PSI2OCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNjYmQ1ZTEiPl9hMWIyYzMuZXhhbXBsZS5jb20gIENOQU1FPC90ZXh0Pgo8dGV4dCB4PSIyMzQiIHk9IjgyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2NiZDVlMSI+4oaSIGFuIEFDTSB2YWxpZGF0aW9uIGhvc3Q8L3RleHQ+CjxsaW5lIHgxPSI1MDYiIHkxPSI2NCIgeDI9IjUyOCIgeTI9IjY0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2NtM2cpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHJlY3QgeD0iNTMwIiB5PSIzOCIgd2lkdGg9IjE1OCIgaGVpZ2h0PSI1MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI2MDkiIHk9IjYwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojNmVlN2I3O2ZvbnQtc2l6ZToxMnB4Ij5JU1NVRUQ8L3RleHQ+Cjx0ZXh0IHg9IjYwOSIgeT0iNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZTo5cHgiPnJlYWR5IHRvIGF0dGFjaDwvdGV4dD4KPHRleHQgeD0iMzYyIiB5PSIxMDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5wcm92ZSBjb250cm9sIMK3IHRoZSBwcm9vZiBsaXZlcyBpbiBETlMsIHNvIGl0IHN0YXlzIHZhbGlkIGZvciByZW5ld2FsPC90ZXh0Pgo8dGV4dCB4PSIyNiIgeT0iMTQwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PTiBHT09HTEUgwrcgQSBkbnNfYXV0aG9yaXphdGlvbiBQUk9EVUNFUyBJVFMgT1dOIFZBTElEQVRJT04gQ05BTUU8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxNTIiIHdpZHRoPSIzMzAiIGhlaWdodD0iNzIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDAiIHk9IjE3MiIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4cHg7ZmlsbDojOTRhM2I4Ij5BQ00gwrcgZG9tYWluX3ZhbGlkYXRpb25fb3B0aW9uczwvdGV4dD4KPHRleHQgeD0iNDAiIHk9IjE5MCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNjYmQ1ZTEiPm5hbWUgICBfYTFiMmMzLmV4YW1wbGUuY29tPC90ZXh0Pgo8dGV4dCB4PSI0MCIgeT0iMjA2IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2NiZDVlMSI+dmFsdWUgIENOQU1FIOKGkiBhbiBBQ00gaG9zdDwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIxODQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAyMHB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYTViNGZjIj7iiaE8L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMjAyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjhweCI+RE5TIHZhbGlkYXRpb248L3RleHQ+CjxyZWN0IHg9IjQ4MiIgeT0iMTUyIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjcyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojYTViNGZjIi8+Cjx0ZXh0IHg9IjQ5OCIgeT0iMTcyIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjhweDtmaWxsOiNhNWI0ZmMiPkdDUCDCtyBkbnNfYXV0aG9yaXphdGlvbi5kbnNfcmVzb3VyY2VfcmVjb3JkPC90ZXh0Pgo8dGV4dCB4PSI0OTgiIHk9IjE5MCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNjYmQ1ZTEiPm5hbWUgICBfYTFiMmMzLmV4YW1wbGUuY29tPC90ZXh0Pgo8dGV4dCB4PSI0OTgiIHk9IjIwNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNjYmQ1ZTEiPnZhbHVlICBDTkFNRSDihpIgYSBHb29nbGUgaG9zdDwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjIzMiIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSI0NiIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojNDIyMDA2O3N0cm9rZTojOTI0MDBlIi8+Cjx0ZXh0IHg9IjQwIiB5PSIyNTEiIHN0eWxlPSJmb250OjcwMCAxMHB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojZmJiZjI0Ij5FTUFJTCBBTkQgSFRUUCBWQUxJREFUSU9OIEFSRSBOT1QgU1VQUE9SVEVEPC90ZXh0Pgo8dGV4dCB4PSI0MCIgeT0iMjY4IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojZmJiZjI0Ij5UaGlzIG1hcHBpbmcgdXNlcyBETlMgYXV0aG9yaXphdGlvbi4gQSBjZXJ0aWZpY2F0ZSB1c2luZyBBQ00gZW1haWwgb3IgSFRUUCB2YWxpZGF0aW9uIHN0b3BzIHRoZSBidWlsZCB3aXRoIGFuIGVycm9yLjwvdGV4dD4KPC9zdmc+)

Both clouds prove domain control with a CNAME record in your zone; Google's comes from a DNS authorization.

#### Attaching the certificate

On AWS, a TLS consumer references the certificate by ARN. The load balancer listener, CloudFront distribution, or API gateway performs the TLS handshake.

Google Certificate Manager attaches certificates through a `google_certificate_manager_certificate_map`, whose `certificate_map_entry` records link hostnames to certificates. The target HTTPS proxy picks a certificate by the hostname the client sends (Server Name Indication, SNI). Tensor9 points each reference to the ACM certificate's ARN at the Google certificate instead.

![On AWS the certificate is an ARN set on the listener. On Google Cloud, a certificate map links each hostname to a certificate, and the HTTPS proxy picks the certificate by the hostname the client asks for.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM0IiB2aWV3Qm94PSIwIDAgODM2IDIzNCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MgdGhlIGNlcnRpZmljYXRlIGlzIGFuIEFSTiBzZXQgb24gdGhlIGxpc3RlbmVyLiBPbiBHb29nbGUgQ2xvdWQsIGEgY2VydGlmaWNhdGUgbWFwIGxpbmtzIGVhY2ggaG9zdG5hbWUgdG8gYSBjZXJ0aWZpY2F0ZSwgYW5kIHRoZSBIVFRQUyBwcm94eSBwaWNrcyB0aGUgY2VydGlmaWNhdGUgYnkgdGhlIGhvc3RuYW1lIHRoZSBjbGllbnQgYXNrcyBmb3IuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdjbTQiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImdjbTRnIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiMwNDc4NTciLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzMzNDE1NSI+QVdTIMK3IEFUVEFDSCBCWSBSRUZFUkVOQ0UgwrcgQU4gQVJOIE9OIEEgTElTVEVORVI8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MiIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgzOCw1NCkgc2NhbGUoMC45KSI+PHJlY3QgeD0iMCIgeT0iMCIgd2lkdGg9IjE3IiBoZWlnaHQ9IjIxIiByeD0iMiIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiMzMzQxNTUiLz48bGluZSB4MT0iNCIgeTE9IjYiIHgyPSIxMyIgeTI9IjYiIHN0cm9rZS13aWR0aD0iMS4zIiBvcGFjaXR5PSIuNSIgc3R5bGU9InN0cm9rZTojMzM0MTU1Ii8+PGxpbmUgeDE9IjQiIHkxPSI5LjUiIHgyPSIxMyIgeTI9IjkuNSIgc3Ryb2tlLXdpZHRoPSIxLjMiIG9wYWNpdHk9Ii41IiBzdHlsZT0ic3Ryb2tlOiMzMzQxNTUiLz48bGluZSB4MT0iNCIgeTE9IjEzIiB4Mj0iOS41IiB5Mj0iMTMiIHN0cm9rZS13aWR0aD0iMS4zIiBvcGFjaXR5PSIuNSIgc3R5bGU9InN0cm9rZTojMzM0MTU1Ii8+PGNpcmNsZSBjeD0iMTMuNSIgY3k9IjE2LjUiIHI9IjQuNCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiMzMzQxNTUiLz48cGF0aCBkPSJNMTEgMjAgbC0xLjQgNC40IGwzLjkgLTIuMSBsMy45IDIuMSBsLTEuNCAtNC40IiBzdHJva2Utd2lkdGg9IjEuMiIgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6IzMzNDE1NSIvPjxjaXJjbGUgY3g9IjEzLjUiIGN5PSIxNi41IiByPSIxLjUiIHN0eWxlPSJmaWxsOiMzMzQxNTUiLz48L2c+Cjx0ZXh0IHg9IjEwNiIgeT0iNjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTFweCI+dGhlIGNlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSIxMDYiIHk9Ijg0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjguNXB4O2ZpbGw6IzY0NzQ4YiI+YXJuOuKApjpjZXJ0aWZpY2F0ZS/igKY8L3RleHQ+CjxsaW5lIHgxPSIxNzQiIHkxPSI3MiIgeDI9IjIwNCIgeTI9IjcyIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2NtNCkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSIxODkiIHk9IjYzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjcuNXB4Ij5hdHRhY2g8L3RleHQ+CjxyZWN0IHg9IjIwNiIgeT0iNDIiIHdpZHRoPSIxNTAiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMjgxIiB5PSI2NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMC41cHgiPmxpc3RlbmVyIC8gcHJveHk8L3RleHQ+Cjx0ZXh0IHg9IjI4MSIgeT0iODQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij50ZXJtaW5hdGVzIFRMUzwvdGV4dD4KPHRleHQgeD0iMTkwIiB5PSIxMjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij50aGUgQVJOIGlzIG9ubHkgYSBmaWVsZCBvbiB0aGUgY29uc3VtZXIsIG5vIGF0dGFjaCBvYmplY3Q8L3RleHQ+CjxsaW5lIHgxPSIzNzgiIHkxPSIyMCIgeDI9IjM3OCIgeTI9IjIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzOTYiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNGY0NmU1Ij5HT09HTEUgwrcgQSBjZXJ0aWZpY2F0ZV9tYXAgT04gVEhFIEhUVFBTIFBST1hZPC90ZXh0Pgo8cmVjdCB4PSI0MzAiIHk9IjQyIiB3aWR0aD0iMzgyIiBoZWlnaHQ9Ijk0IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojNGY0NmU1Ii8+Cjx0ZXh0IHg9IjQ0NiIgeT0iNjIiIHN0eWxlPSJmb250OjcwMCAxMS41cHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7ZmlsbDojNGY0NmU1Ij5jZXJ0aWZpY2F0ZV9tYXA8L3RleHQ+CjxyZWN0IHg9IjQ0NiIgeT0iNzAiIHdpZHRoPSIzNTAiIGhlaWdodD0iMjIiIHJ4PSI2IiBzdHJva2Utd2lkdGg9IjEiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDU2IiB5PSI4NSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiMzMzQxNTUiPmV4YW1wbGUuY29tICAgICAg4oaSIGNlcnRpZmljYXRlPC90ZXh0Pgo8cmVjdCB4PSI0NDYiIHk9Ijk2IiB3aWR0aD0iMzUwIiBoZWlnaHQ9IjIyIiByeD0iNiIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ1NiIgeT0iMTExIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzMzNDE1NSI+YXBpLmV4YW1wbGUuY29tICDihpIgY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjQ0NiIgeT0iMTMwIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjhweDtmaWxsOiM2NDc0OGIiPmNlcnRpZmljYXRlX21hcF9lbnRyeSDCtyBrZXllZCBieSBob3N0bmFtZSAoU05JKTwvdGV4dD4KPGxpbmUgeDE9IjYyMSIgeTE9IjEzNiIgeDI9IjYyMSIgeTI9IjE1MiIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjZ2NtNGcpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHJlY3QgeD0iNDMwIiB5PSIxNTQiIHdpZHRoPSIzODIiIGhlaWdodD0iNDYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjIxIiB5PSIxNzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTFweCI+dGhlIHRhcmdldCBIVFRQUyBwcm94eTwvdGV4dD4KPHRleHQgeD0iNjIxIiB5PSIxOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZTo5LjVweCI+Y29uc3VsdHMgdGhlIG1hcCDCtyBzZXJ2ZXMgdGhlIHJpZ2h0IGNlcnRpZmljYXRlIHBlciBTTkk8L3RleHQ+Cjwvc3ZnPg==)

![On AWS the certificate is an ARN set on the listener. On Google Cloud, a certificate map links each hostname to a certificate, and the HTTPS proxy picks the certificate by the hostname the client asks for.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM0IiB2aWV3Qm94PSIwIDAgODM2IDIzNCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MgdGhlIGNlcnRpZmljYXRlIGlzIGFuIEFSTiBzZXQgb24gdGhlIGxpc3RlbmVyLiBPbiBHb29nbGUgQ2xvdWQsIGEgY2VydGlmaWNhdGUgbWFwIGxpbmtzIGVhY2ggaG9zdG5hbWUgdG8gYSBjZXJ0aWZpY2F0ZSwgYW5kIHRoZSBIVFRQUyBwcm94eSBwaWNrcyB0aGUgY2VydGlmaWNhdGUgYnkgdGhlIGhvc3RuYW1lIHRoZSBjbGllbnQgYXNrcyBmb3IuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdjbTQiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImdjbTRnIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2ZWU3YjciLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2NiZDVlMSI+QVdTIMK3IEFUVEFDSCBCWSBSRUZFUkVOQ0UgwrcgQU4gQVJOIE9OIEEgTElTVEVORVI8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MiIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgzOCw1NCkgc2NhbGUoMC45KSI+PHJlY3QgeD0iMCIgeT0iMCIgd2lkdGg9IjE3IiBoZWlnaHQ9IjIxIiByeD0iMiIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiNjYmQ1ZTEiLz48bGluZSB4MT0iNCIgeTE9IjYiIHgyPSIxMyIgeTI9IjYiIHN0cm9rZS13aWR0aD0iMS4zIiBvcGFjaXR5PSIuNSIgc3R5bGU9InN0cm9rZTojY2JkNWUxIi8+PGxpbmUgeDE9IjQiIHkxPSI5LjUiIHgyPSIxMyIgeTI9IjkuNSIgc3Ryb2tlLXdpZHRoPSIxLjMiIG9wYWNpdHk9Ii41IiBzdHlsZT0ic3Ryb2tlOiNjYmQ1ZTEiLz48bGluZSB4MT0iNCIgeTE9IjEzIiB4Mj0iOS41IiB5Mj0iMTMiIHN0cm9rZS13aWR0aD0iMS4zIiBvcGFjaXR5PSIuNSIgc3R5bGU9InN0cm9rZTojY2JkNWUxIi8+PGNpcmNsZSBjeD0iMTMuNSIgY3k9IjE2LjUiIHI9IjQuNCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiNjYmQ1ZTEiLz48cGF0aCBkPSJNMTEgMjAgbC0xLjQgNC40IGwzLjkgLTIuMSBsMy45IDIuMSBsLTEuNCAtNC40IiBzdHJva2Utd2lkdGg9IjEuMiIgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6I2NiZDVlMSIvPjxjaXJjbGUgY3g9IjEzLjUiIGN5PSIxNi41IiByPSIxLjUiIHN0eWxlPSJmaWxsOiNjYmQ1ZTEiLz48L2c+Cjx0ZXh0IHg9IjEwNiIgeT0iNjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTFweCI+dGhlIGNlcnRpZmljYXRlPC90ZXh0Pgo8dGV4dCB4PSIxMDYiIHk9Ijg0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjguNXB4O2ZpbGw6Izk0YTNiOCI+YXJuOuKApjpjZXJ0aWZpY2F0ZS/igKY8L3RleHQ+CjxsaW5lIHgxPSIxNzQiIHkxPSI3MiIgeDI9IjIwNCIgeTI9IjcyIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2NtNCkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSIxODkiIHk9IjYzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjcuNXB4Ij5hdHRhY2g8L3RleHQ+CjxyZWN0IHg9IjIwNiIgeT0iNDIiIHdpZHRoPSIxNTAiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMjgxIiB5PSI2NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMC41cHgiPmxpc3RlbmVyIC8gcHJveHk8L3RleHQ+Cjx0ZXh0IHg9IjI4MSIgeT0iODQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij50ZXJtaW5hdGVzIFRMUzwvdGV4dD4KPHRleHQgeD0iMTkwIiB5PSIxMjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij50aGUgQVJOIGlzIG9ubHkgYSBmaWVsZCBvbiB0aGUgY29uc3VtZXIsIG5vIGF0dGFjaCBvYmplY3Q8L3RleHQ+CjxsaW5lIHgxPSIzNzgiIHkxPSIyMCIgeDI9IjM3OCIgeTI9IjIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzOTYiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojYTViNGZjIj5HT09HTEUgwrcgQSBjZXJ0aWZpY2F0ZV9tYXAgT04gVEhFIEhUVFBTIFBST1hZPC90ZXh0Pgo8cmVjdCB4PSI0MzAiIHk9IjQyIiB3aWR0aD0iMzgyIiBoZWlnaHQ9Ijk0IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojYTViNGZjIi8+Cjx0ZXh0IHg9IjQ0NiIgeT0iNjIiIHN0eWxlPSJmb250OjcwMCAxMS41cHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7ZmlsbDojYTViNGZjIj5jZXJ0aWZpY2F0ZV9tYXA8L3RleHQ+CjxyZWN0IHg9IjQ0NiIgeT0iNzAiIHdpZHRoPSIzNTAiIGhlaWdodD0iMjIiIHJ4PSI2IiBzdHJva2Utd2lkdGg9IjEiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDU2IiB5PSI4NSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNjYmQ1ZTEiPmV4YW1wbGUuY29tICAgICAg4oaSIGNlcnRpZmljYXRlPC90ZXh0Pgo8cmVjdCB4PSI0NDYiIHk9Ijk2IiB3aWR0aD0iMzUwIiBoZWlnaHQ9IjIyIiByeD0iNiIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ1NiIgeT0iMTExIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2NiZDVlMSI+YXBpLmV4YW1wbGUuY29tICDihpIgY2VydGlmaWNhdGU8L3RleHQ+Cjx0ZXh0IHg9IjQ0NiIgeT0iMTMwIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjhweDtmaWxsOiM5NGEzYjgiPmNlcnRpZmljYXRlX21hcF9lbnRyeSDCtyBrZXllZCBieSBob3N0bmFtZSAoU05JKTwvdGV4dD4KPGxpbmUgeDE9IjYyMSIgeTE9IjEzNiIgeDI9IjYyMSIgeTI9IjE1MiIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgjZ2NtNGcpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHJlY3QgeD0iNDMwIiB5PSIxNTQiIHdpZHRoPSIzODIiIGhlaWdodD0iNDYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNjIxIiB5PSIxNzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTFweCI+dGhlIHRhcmdldCBIVFRQUyBwcm94eTwvdGV4dD4KPHRleHQgeD0iNjIxIiB5PSIxOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZTo5LjVweCI+Y29uc3VsdHMgdGhlIG1hcCDCtyBzZXJ2ZXMgdGhlIHJpZ2h0IGNlcnRpZmljYXRlIHBlciBTTkk8L3RleHQ+Cjwvc3ZnPg==)

On AWS the certificate is an ARN on the listener; on Google a certificate map links hostnames to certificates.

#### Private key access

Default ACM public certificates are non-exportable: `GetCertificate` returns the certificate and chain without the key. Since 2025, ACM has also offered opt-in exportable public certificates.

Google never exposes a managed certificate's private key, and a self-managed certificate's `pem_private_key` is accepted as input but never returned on read. So moving here does not widen who can read the key. ACM's opt-in key export is not reproduced.

![ACM returns a default certificate and chain but never its private key. Google never returns a managed certificate's key, or the key supplied with a self-managed certificate.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgODM2IDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gcmV0dXJucyBhIGRlZmF1bHQgY2VydGlmaWNhdGUgYW5kIGNoYWluIGJ1dCBuZXZlciBpdHMgcHJpdmF0ZSBrZXkuIEdvb2dsZSBuZXZlciByZXR1cm5zIGEgbWFuYWdlZCBjZXJ0aWZpY2F0ZSdzIGtleSwgb3IgdGhlIGtleSBzdXBwbGllZCB3aXRoIGEgc2VsZi1tYW5hZ2VkIGNlcnRpZmljYXRlLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJnY201IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzMzNDE1NSI+RGVmYXVsdCBBQ00gcHJpdmF0ZS1rZXkgYWNjZXNzPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMzgiIHdpZHRoPSIxNTAiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iOTkiIHk9IjYzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExcHgiPkFDTSBjZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iOTkiIHk9IjgwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjguNXB4O2ZpbGw6IzY0NzQ4YiI+R2V0Q2VydGlmaWNhdGU8L3RleHQ+CjxsaW5lIHgxPSIxNzQiIHkxPSI2NyIgeDI9IjIwNiIgeTI9IjY3IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2NtNSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyMDgiIHk9IjM4IiB3aWR0aD0iMTg4IiBoZWlnaHQ9IjU4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwMiIgeT0iNjMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPmNlcnRpZmljYXRlICsgY2hhaW4g4pyTPC90ZXh0Pgo8dGV4dCB4PSIzMDIiIHk9IjgwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+cmV0dXJuZWQgdG8gdGhlIGNhbGxlcjwvdGV4dD4KPHJlY3QgeD0iNDIwIiB5PSIzOCIgd2lkdGg9IjIwMCIgaGVpZ2h0PSI1OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA0IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDQzOCw1Mikgc2NhbGUoMS4xKSI+PHBhdGggZD0iTTQgOCBWNiBhNSA1IDAgMCAxIDEwIDAgVjgiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0ic3Ryb2tlOiMzMzQxNTUiLz48cmVjdCB4PSIyIiB5PSI4IiB3aWR0aD0iMTQiIGhlaWdodD0iMTEiIHJ4PSIyLjIiIHN0eWxlPSJmaWxsOiMzMzQxNTUiLz48Y2lyY2xlIGN4PSI5IiBjeT0iMTIuNSIgcj0iMS43IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PHJlY3QgeD0iOC4yIiB5PSIxMyIgd2lkdGg9IjEuNiIgaGVpZ2h0PSIzLjYiIHJ4PSIwLjgiIHN0eWxlPSJmaWxsOiNmZmZmZmYiLz48L2c+Cjx0ZXh0IHg9IjUyNCIgeT0iNjMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPnByaXZhdGUga2V5PC90ZXh0Pgo8dGV4dCB4PSI1MjQiIHk9IjgwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+c3RheXMgaW5zaWRlLCBuZXZlciByZXR1cm5lZDwvdGV4dD4KPHRleHQgeD0iNzIyIiB5PSI2MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNjQ3NDhiIj5zaW5jZSAyMDI1IGFuIG9wdC1pbiBleHBvcnRhYmxlPC90ZXh0Pgo8dGV4dCB4PSI3MjIiIHk9Ijc0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiM2NDc0OGIiPmNlcnRpZmljYXRlIGNhbiByZXR1cm4gaXRzIGtleSw8L3RleHQ+Cjx0ZXh0IHg9IjcyMiIgeT0iODgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6IzY0NzQ4YiI+dGhlIGRlZmF1bHQgc3RheXMgbm9uLWV4cG9ydGFibGU8L3RleHQ+Cjx0ZXh0IHg9IjI2IiB5PSIxMjIiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiMwNDc4NTciPkdvb2dsZSBwcml2YXRlLWtleSBhY2Nlc3M8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxMzQiIHdpZHRoPSIzODYiIGhlaWdodD0iODgiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiM0ZjQ2ZTUiLz4KPHRleHQgeD0iMTEyIiB5PSIxNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMnB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlO2ZpbGw6IzRmNDZlNSI+bWFuYWdlZDwvdGV4dD4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMTk2LDE0Nikgc2NhbGUoMS4xNSkiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PC9nPgo8dGV4dCB4PSIyMTciIHk9IjE4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDEwcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiMwNDc4NTciPnVucmVhZGFibGU8L3RleHQ+Cjx0ZXh0IHg9IjIxNyIgeT0iMjA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij50aGUga2V5IGlzIEdvb2dsZS1oZWxkIMK3IG5ldmVyIGFjY2Vzc2libGU8L3RleHQ+CjxyZWN0IHg9IjQyNiIgeT0iMTM0IiB3aWR0aD0iMzg2IiBoZWlnaHQ9Ijg4IiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjUyMCIgeT0iMTU4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTJweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTtmaWxsOiMzMzQxNTUiPnNlbGZfbWFuYWdlZDwvdGV4dD4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoNjAwLDE0Nikgc2NhbGUoMS4xNSkiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PC9nPgo8dGV4dCB4PSI2MTkiIHk9IjE4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDEwcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiMwNDc4NTciPmlucHV0LW9ubHk8L3RleHQ+Cjx0ZXh0IHg9IjYxOSIgeT0iMjA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij5wZW1fcHJpdmF0ZV9rZXkgaXMgbmV2ZXIgcmV0dXJuZWQgb24gcmVhZDwvdGV4dD4KPC9zdmc+)

![ACM returns a default certificate and chain but never its private key. Google never returns a managed certificate's key, or the key supplied with a self-managed certificate.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgODM2IDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBQ00gcmV0dXJucyBhIGRlZmF1bHQgY2VydGlmaWNhdGUgYW5kIGNoYWluIGJ1dCBuZXZlciBpdHMgcHJpdmF0ZSBrZXkuIEdvb2dsZSBuZXZlciByZXR1cm5zIGEgbWFuYWdlZCBjZXJ0aWZpY2F0ZSdzIGtleSwgb3IgdGhlIGtleSBzdXBwbGllZCB3aXRoIGEgc2VsZi1tYW5hZ2VkIGNlcnRpZmljYXRlLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJnY201IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZpbGw6I2NiZDVlMSI+RGVmYXVsdCBBQ00gcHJpdmF0ZS1rZXkgYWNjZXNzPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMzgiIHdpZHRoPSIxNTAiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iOTkiIHk9IjYzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExcHgiPkFDTSBjZXJ0aWZpY2F0ZTwvdGV4dD4KPHRleHQgeD0iOTkiIHk9IjgwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjguNXB4O2ZpbGw6Izk0YTNiOCI+R2V0Q2VydGlmaWNhdGU8L3RleHQ+CjxsaW5lIHgxPSIxNzQiIHkxPSI2NyIgeDI9IjIwNiIgeTI9IjY3IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2NtNSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyMDgiIHk9IjM4IiB3aWR0aD0iMTg4IiBoZWlnaHQ9IjU4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwMiIgeT0iNjMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPmNlcnRpZmljYXRlICsgY2hhaW4g4pyTPC90ZXh0Pgo8dGV4dCB4PSIzMDIiIHk9IjgwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+cmV0dXJuZWQgdG8gdGhlIGNhbGxlcjwvdGV4dD4KPHJlY3QgeD0iNDIwIiB5PSIzOCIgd2lkdGg9IjIwMCIgaGVpZ2h0PSI1OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA0IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDQzOCw1Mikgc2NhbGUoMS4xKSI+PHBhdGggZD0iTTQgOCBWNiBhNSA1IDAgMCAxIDEwIDAgVjgiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0ic3Ryb2tlOiNjYmQ1ZTEiLz48cmVjdCB4PSIyIiB5PSI4IiB3aWR0aD0iMTQiIGhlaWdodD0iMTEiIHJ4PSIyLjIiIHN0eWxlPSJmaWxsOiNjYmQ1ZTEiLz48Y2lyY2xlIGN4PSI5IiBjeT0iMTIuNSIgcj0iMS43IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PHJlY3QgeD0iOC4yIiB5PSIxMyIgd2lkdGg9IjEuNiIgaGVpZ2h0PSIzLjYiIHJ4PSIwLjgiIHN0eWxlPSJmaWxsOiMxZTI5M2IiLz48L2c+Cjx0ZXh0IHg9IjUyNCIgeT0iNjMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPnByaXZhdGUga2V5PC90ZXh0Pgo8dGV4dCB4PSI1MjQiIHk9IjgwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+c3RheXMgaW5zaWRlLCBuZXZlciByZXR1cm5lZDwvdGV4dD4KPHRleHQgeD0iNzIyIiB5PSI2MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojOTRhM2I4Ij5zaW5jZSAyMDI1IGFuIG9wdC1pbiBleHBvcnRhYmxlPC90ZXh0Pgo8dGV4dCB4PSI3MjIiIHk9Ijc0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiM5NGEzYjgiPmNlcnRpZmljYXRlIGNhbiByZXR1cm4gaXRzIGtleSw8L3RleHQ+Cjx0ZXh0IHg9IjcyMiIgeT0iODgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6Izk0YTNiOCI+dGhlIGRlZmF1bHQgc3RheXMgbm9uLWV4cG9ydGFibGU8L3RleHQ+Cjx0ZXh0IHg9IjI2IiB5PSIxMjIiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmaWxsOiM2ZWU3YjciPkdvb2dsZSBwcml2YXRlLWtleSBhY2Nlc3M8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxMzQiIHdpZHRoPSIzODYiIGhlaWdodD0iODgiIHJ4PSIxMiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiNhNWI0ZmMiLz4KPHRleHQgeD0iMTEyIiB5PSIxNTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMnB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlO2ZpbGw6I2E1YjRmYyI+bWFuYWdlZDwvdGV4dD4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMTk2LDE0Nikgc2NhbGUoMS4xNSkiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PC9nPgo8dGV4dCB4PSIyMTciIHk9IjE4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDEwcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiM2ZWU3YjciPnVucmVhZGFibGU8L3RleHQ+Cjx0ZXh0IHg9IjIxNyIgeT0iMjA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij50aGUga2V5IGlzIEdvb2dsZS1oZWxkIMK3IG5ldmVyIGFjY2Vzc2libGU8L3RleHQ+CjxyZWN0IHg9IjQyNiIgeT0iMTM0IiB3aWR0aD0iMzg2IiBoZWlnaHQ9Ijg4IiByeD0iMTIiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjUyMCIgeT0iMTU4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTJweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTtmaWxsOiNjYmQ1ZTEiPnNlbGZfbWFuYWdlZDwvdGV4dD4KPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoNjAwLDE0Nikgc2NhbGUoMS4xNSkiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PC9nPgo8dGV4dCB4PSI2MTkiIHk9IjE4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDEwcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiM2ZWU3YjciPmlucHV0LW9ubHk8L3RleHQ+Cjx0ZXh0IHg9IjYxOSIgeT0iMjA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij5wZW1fcHJpdmF0ZV9rZXkgaXMgbmV2ZXIgcmV0dXJuZWQgb24gcmVhZDwvdGV4dD4KPC9zdmc+)

Google never returns managed private keys or the private keys supplied with imported certificates.

#### Limitations

Where Google Certificate Manager and ACM differ

* **Email and HTTP validation are not supported.** This mapping uses DNS authorization. A certificate with `validation_method` `EMAIL` or `HTTP` stops the build with an error.
* **Imported ACM certificates are not supported.** A certificate imported into ACM with `certificate_body` and `private_key` stops the build with an error. Tensor9 creates only Google-managed certificates.
* **Choosing the key algorithm is not supported.** Google chooses the key for a managed certificate. A certificate whose `key_algorithm` is anything other than `RSA_2048` stops the build with an error, and keys cannot be exported.
* **Private CA and exportable ACM certificates are not supported.** A certificate that sets `certificate_authority_arn`, or `options.export = ENABLED`, stops the build with an error rather than being reissued as a public certificate with a new key.
* **Subject alternative names from variables behave differently.** Alternative names Tensor9 cannot read when it builds the deployment are left off the certificate, and the build reports a warning. A primary `domain_name` from a variable is resolved at deployment.
* **Certificate attachment behaves differently.** A certificate map links hostnames to certificates on the HTTPS proxy, instead of an ARN on each listener. Check each hostname and each attachment when the AWS ARN is replaced.
* **Other ACM options are not supported.** Public certificates are logged; ACM has deprecated its transparency-logging opt-out, and this mapping does not keep it. ACM hosted-ACME settings are not reproduced.

#### Other considerations

* **DNS records.** The Cloud DNS zone for each domain must exist. Keep the DNS authorization CNAME records in place: Google needs them to renew the certificate.
* **Who does what.** You control the Google project, the DNS zone and the load balancer. Google issues and renews managed certificates. Confirm the proxy serves the right certificate for every hostname.
* **Moving from AWS.** Google issues new certificates during installation. Existing ACM certificates and keys are not transferred.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### AWS ACM public certificates · Active public certificates

Feature: AWS ACM public certificates.

Estimated monthly service charges by Active public certificates. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: global; currency: USD.

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/e9504d44846ab2c4cfe1cb2881e57a9e888520e5ddad83dd09af2141219caef3-light.svg)

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/0697ffa20b9dd65c95bf0034a7eadbf9317c933ee39e0fa4e85d0c87d3e43d06-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Active public certificates (certificates) | ACM Certificate | Target scenario | Certificate Manager | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | Certificate Manager (one staging copy) | 118.18 | 118.18 |
| 0 | 0.00 | Certificate Manager (two staging copies) | 236.36 | 236.36 |
| 10 | 0.00 | Certificate Manager (one staging copy) | 118.18 | 118.18 |
| 10 | 0.00 | Certificate Manager (two staging copies) | 236.36 | 236.36 |
| 100 | 0.00 | Certificate Manager (one staging copy) | 118.18 | 118.18 |
| 100 | 0.00 | Certificate Manager (two staging copies) | 236.36 | 236.36 |
| 1,000 | 0.00 | Certificate Manager (one staging copy) | 298.18 | 298.18 |
| 1,000 | 0.00 | Certificate Manager (two staging copies) | 416.36 | 416.36 |
| 10,000 | 0.00 | Certificate Manager (one staging copy) | 1,298.18 | 1,298.18 |
| 10,000 | 0.00 | Certificate Manager (two staging copies) | 1,416.36 | 1,416.36 |
| 100,000 | 0.00 | Certificate Manager (one staging copy) | 10,298.18 | 10,298.18 |
| 100,000 | 0.00 | Certificate Manager (two staging copies) | 10,416.36 | 10,416.36 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Certificate Manager (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Certificate Manager (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Certificate Manager (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| Certificate Manager (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| Certificate Manager (one staging copy) | Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| Certificate Manager (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| Certificate Manager (one staging copy) | Target price guess · read | 0 | USD/read |
| Certificate Manager (one staging copy) | Target price guess · write | 0 | USD/write |
| Certificate Manager (one staging copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Certificate Manager (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Certificate Manager (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Certificate Manager (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Certificate Manager (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Certificate Manager (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Certificate Manager (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Certificate Manager (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Certificate Manager (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Certificate Manager (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| Certificate Manager (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Certificate Manager (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Certificate Manager (one staging copy) | Target monthly base charge | 0 | USD/month |
| Certificate Manager (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Certificate Manager (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Certificate Manager (one staging copy) | Minimum primary RAM | 8 | GiB |
| Certificate Manager (one staging copy) | Minimum primary disk | 100 | GiB |
| Certificate Manager (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Certificate Manager (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Certificate Manager (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Certificate Manager (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Certificate Manager (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Certificate Manager (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Certificate Manager (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Certificate Manager (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Certificate Manager (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Certificate Manager (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Certificate Manager (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Certificate Manager (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Certificate Manager (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Certificate Manager (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Certificate Manager (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Certificate Manager (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| Certificate Manager (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| Certificate Manager (two staging copies) | Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| Certificate Manager (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| Certificate Manager (two staging copies) | Target price guess · read | 0 | USD/read |
| Certificate Manager (two staging copies) | Target price guess · write | 0 | USD/write |
| Certificate Manager (two staging copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Certificate Manager (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Certificate Manager (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Certificate Manager (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Certificate Manager (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Certificate Manager (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Certificate Manager (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Certificate Manager (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Certificate Manager (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Certificate Manager (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| Certificate Manager (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Certificate Manager (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Certificate Manager (two staging copies) | Target monthly base charge | 0 | USD/month |
| Certificate Manager (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Certificate Manager (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Certificate Manager (two staging copies) | Minimum primary RAM | 8 | GiB |
| Certificate Manager (two staging copies) | Minimum primary disk | 100 | GiB |
| Certificate Manager (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Certificate Manager (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Certificate Manager (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Certificate Manager (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Certificate Manager (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Certificate Manager (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Certificate Manager (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Certificate Manager (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Certificate Manager (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Certificate Manager (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Certificate Manager (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Certificate Manager (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Certificate Manager (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → global, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source price. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* Certificate Manager bills deployed certificates per project: the first 100 a month are free, then USD 0.20 per certificate-month to 2,000 and 0.10 above. RSA-3072/4096 TLS and mTLS connections (0.45 per million) are not modeled; DNS challenges, hosting and durable adapter state remain separately allocated.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* Certificate Manager pricing: [https://cloud.google.com/certificate-manager/pricing](https://cloud.google.com/certificate-manager/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-168d6137ea51de31531b7d13e78d3b865c15f0df` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [Certificate Manager pricing](https://cloud.google.com/certificate-manager/pricing).

##### AWS ACM public certificates · Certificate issuances and renewals

Feature: AWS ACM public certificates.

Estimated monthly service charges by Certificate issuances and renewals. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: global; currency: USD.

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/8f65e1ee38a326a0ddab792a43296efc1d7bc0a020388bb3c6785ce26dda38f2-light.svg)

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/8b6da2b9cc92e7ec6ecd03d8731a79c41b1aad8c7b70f48ae179d60fe0493c9c-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Certificate issuances and renewals (issuances/month) | ACM Certificate | Target scenario | Certificate Manager | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | Certificate Manager (one staging copy) | 118.18 | 118.18 |
| 0 | 0.00 | Certificate Manager (two staging copies) | 236.36 | 236.36 |
| 10 | 0.00 | Certificate Manager (one staging copy) | 118.18 | 118.18 |
| 10 | 0.00 | Certificate Manager (two staging copies) | 236.36 | 236.36 |
| 100 | 0.00 | Certificate Manager (one staging copy) | 118.18 | 118.18 |
| 100 | 0.00 | Certificate Manager (two staging copies) | 236.36 | 236.36 |
| 1,000 | 0.00 | Certificate Manager (one staging copy) | 118.18 | 118.18 |
| 1,000 | 0.00 | Certificate Manager (two staging copies) | 236.36 | 236.36 |
| 10,000 | 0.00 | Certificate Manager (one staging copy) | 118.18 | 118.18 |
| 10,000 | 0.00 | Certificate Manager (two staging copies) | 236.36 | 236.36 |
| 100,000 | 0.00 | Certificate Manager (one staging copy) | 118.18 | 118.18 |
| 100,000 | 0.00 | Certificate Manager (two staging copies) | 236.36 | 236.36 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Certificate Manager (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Certificate Manager (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Certificate Manager (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| Certificate Manager (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| Certificate Manager (one staging copy) | Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| Certificate Manager (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| Certificate Manager (one staging copy) | Target price guess · read | 0 | USD/read |
| Certificate Manager (one staging copy) | Target price guess · write | 0 | USD/write |
| Certificate Manager (one staging copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Certificate Manager (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Certificate Manager (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Certificate Manager (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Certificate Manager (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Certificate Manager (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Certificate Manager (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Certificate Manager (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Certificate Manager (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Certificate Manager (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| Certificate Manager (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Certificate Manager (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Certificate Manager (one staging copy) | Target monthly base charge | 0 | USD/month |
| Certificate Manager (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Certificate Manager (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Certificate Manager (one staging copy) | Minimum primary RAM | 8 | GiB |
| Certificate Manager (one staging copy) | Minimum primary disk | 100 | GiB |
| Certificate Manager (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Certificate Manager (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Certificate Manager (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Certificate Manager (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Certificate Manager (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Certificate Manager (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Certificate Manager (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Certificate Manager (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Certificate Manager (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Certificate Manager (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Certificate Manager (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Certificate Manager (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Certificate Manager (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Certificate Manager (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Certificate Manager (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Certificate Manager (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| Certificate Manager (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| Certificate Manager (two staging copies) | Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| Certificate Manager (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| Certificate Manager (two staging copies) | Target price guess · read | 0 | USD/read |
| Certificate Manager (two staging copies) | Target price guess · write | 0 | USD/write |
| Certificate Manager (two staging copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Certificate Manager (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Certificate Manager (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Certificate Manager (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Certificate Manager (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Certificate Manager (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Certificate Manager (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Certificate Manager (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Certificate Manager (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Certificate Manager (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| Certificate Manager (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Certificate Manager (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Certificate Manager (two staging copies) | Target monthly base charge | 0 | USD/month |
| Certificate Manager (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Certificate Manager (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Certificate Manager (two staging copies) | Minimum primary RAM | 8 | GiB |
| Certificate Manager (two staging copies) | Minimum primary disk | 100 | GiB |
| Certificate Manager (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Certificate Manager (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Certificate Manager (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Certificate Manager (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Certificate Manager (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Certificate Manager (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Certificate Manager (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Certificate Manager (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Certificate Manager (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Certificate Manager (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Certificate Manager (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Certificate Manager (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Certificate Manager (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory remains at its authored default; issuance and renewal traffic varies independently. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → global, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source price. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* Certificate Manager bills deployed certificates per project: the first 100 a month are free, then USD 0.20 per certificate-month to 2,000 and 0.10 above. RSA-3072/4096 TLS and mTLS connections (0.45 per million) are not modeled; DNS challenges, hosting and durable adapter state remain separately allocated.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* Certificate Manager pricing: [https://cloud.google.com/certificate-manager/pricing](https://cloud.google.com/certificate-manager/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-168d6137ea51de31531b7d13e78d3b865c15f0df` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [Certificate Manager pricing](https://cloud.google.com/certificate-manager/pricing).

**AWS ACM public certificates → Certificate Manager: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: global. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: Public non-exportable certificate inventory | 0.00 |
| Origin: Certificate issues and renewals | 0.00 |
| Origin: Certificate management reads | 0.00 |
| Target: Target retained physical data | 0.00 |
| Target: Additional broker replica storage | 0.00 |
| Target: Target native provider operations | 0.00 |
| Target: Execution or worker CPU | 0.00 |
| Target: Execution or worker RAM | 0.00 |
| Target: Selected billable network | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Durable staging CPU | 60.30 |
| Target: Durable staging RAM | 40.88 |
| Target: Durable staging disk | 17.00 |
| **Origin service subtotal** | **0.00** |
| **Target service subtotal** | **118.18** |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Origin list price · Certificate management reads | 0 | USD/requests |
| Provider operations per issuance | 20 | operations/issuance |
| Physical certificate and lifecycle state | 32,768 | bytes/certificate |
| Issuance retry multiplier | 1.1 | multiplier |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target price guess · GiB-month | 0 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target price guess · network GiB | 0 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target list price · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| Public non-exportable certificate inventory | 100 | certificate-month |
| Certificate issues and renewals | 33 | issuances |
| Certificate management reads | 10,000 | requests |

* Translated reads: 10,000 operations.

* Translated writes: 33 operations.

* Translated resident physical data: under 0.01 GiB-month.

* Native provider operations: 726 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 0 vCPU-hour.

* Allocated execution RAM: 0 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 100 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.

* Public non-exportable source certificates have a zero authored source price. Exportable certificates and private-CA certificates require different models.

* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.

* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.

* Certificate Manager bills deployed certificates per project: the first 100 a month are free, then USD 0.20 per certificate-month to 2,000 and 0.10 above. RSA-3072/4096 TLS and mTLS connections (0.45 per million) are not modeled; DNS challenges, hosting and durable adapter state remain separately allocated.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-168d6137ea51de31531b7d13e78d3b865c15f0df` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [Certificate Manager pricing](https://cloud.google.com/certificate-manager/pricing).

## Costs

Estimated monthly service charges for each backend with a published cost model, at one sampled workload from that model's cost curve. Adapter hosting and Tensor9 fees are excluded. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method, what the estimates include and how to read their qualifications.

| Backend | Sampled workload | Price basis | Origin USD/month | Backend USD/month | Difference | Mapping |
| - | - | - | -: | -: | -: | - |
| Certificate Manager | Active public certificates: 1,000 certificates; one staging copy | Cited list prices, 2026-10-22 | 0.00 | 298.18 | +298.18 | Service adapter |
| Key Vault | Active public certificates: 1,000 certificates; one staging copy | Cited list prices, 2026-10-22 | 0.00 | 118.18 | +118.18 | Service adapter |
| cert-manager Certificate | Active public certificates: 1,000 certificates; one staging copy | Cited list prices, 2026-10-22 | 0.00 | 118.18 | +118.18 | Service adapter |

Difference means backend minus origin; a positive difference means the backend costs more. Workloads and target configurations differ by model, so compare each row's difference at its stated workload rather than charges across rows.
Cost curves across workload sizes, with every assumption and exclusion: [ACM Certificate costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/additional-services/aws-acm).

## Service level agreements

> [!WARNING]
>
> These tables show Tensor9's standard service levels and adapters whose standard terms are still being defined. Your signed agreement determines the SLAs, covered adapters and operations, limits, remedies and support terms that apply to your deployment.

Listed terms cover requests sent through this service adapter. They do not cover direct connections to the target service or replace the cloud provider's own SLA. Each origin-to-target pair has its own terms or an explicit pending status.

See the [SLA tables](https://docs.tensor9.com/cloud-adapter-early-access/support/service-adapter-slas.md), [measurement rules](https://docs.tensor9.com/cloud-adapter-early-access/support/service-levels.md), and [scaling conditions](https://docs.tensor9.com/cloud-adapter-early-access/support/scaling-and-limits.md).

### ACM Certificate to Key Vault

**SLA status:** Pending

Operation-specific service levels for this adapter have not yet been defined. This adapter does not inherit another target service's latency budget. Your signed agreement sets the applicable terms.

### ACM Certificate to cert-manager Certificate

**SLA status:** Pending

Operation-specific service levels for this adapter have not yet been defined. This adapter does not inherit another target service's latency budget. Your signed agreement sets the applicable terms.

### ACM Certificate to Certificate Manager

**SLA status:** Pending

Operation-specific service levels for this adapter have not yet been defined. This adapter does not inherit another target service's latency budget. Your signed agreement sets the applicable terms.

## Install and run

The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin:

```sh theme={null}
tensor9 adapt svc list \
  -origin aws::1.0.0::acm
```

The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request.

Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction.

## Existing data and credentials

Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target.

## Configure, tune and debug

Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction.

For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.