Which AWS service can renew and deploy SSL/TLS certificates automatically before they expire?
Show answer and explanation
Answer: B
ACM issues public certificates and renews them automatically as long as they are attached to an integrated service such as CloudFront, an Application Load Balancer, or API Gateway. Renewal happens before expiry and the new certificate is redeployed to the associated resource. Certificates used outside integrated services require manual handling.
Why the other options are wrong
- A. KMS manages encryption keys, not TLS certificate issuance or renewal.
- C. Secrets Manager stores secrets and can rotate them, but it does not provision or deploy TLS certificates to load balancers.
- D. Private CA issues private certificates but does not provide automatic renewal and deployment for public certificates the way ACM does.