Your team starts to use AWS Certificate Manager to issue new certificates and manage existing certificates. Private Certificate Authorities are also created in ACM. ACM contains both public and private certificates which are used for different AWS services. You also need ACM to help to renew certificates before they expire. In which of the following options can ACM perform the automatic renewal?

Answer options:

A.A third-party certificate is imported to ACM and is associated with a CloudFront distribution.
B.A private CA certificate for which ACM does not create the private key and certificate signing request (CSR). The certificate is installed in an elastic load balancer.
C.A private certificate is issued from the ACM management console and used for an Application Load Balancer.
D.A public certificate is requested from ACM and is NOT associated with any AWS service.

Correct Answer – C
ACM provides managed renewal for the SSL/TLS certificates in ACM. However, there are some limitations. Refer to the details in
https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html.
Option A is incorrect: Because an automatic renewal is not available for imported certificates. You have to manage the renewal by yourself.
Option B is incorrect: Because if the private keys are managed by users instead of ACM, ACM does not renew the certificates.
Option C is CORRECT: In this option, ACM can fully manage the automatic renewal for the certificates.
Option D is incorrect: Because an ACM certificate must be actively associated with an AWS service before it can be automatically renewed by ACM.