Updates (April 2026 to June 2026)
June 2026 — Updated the topic to add information about the auto procurement and renewal of TLS certificates. For more information, see Certificate management approaches.
Certificate management is essential for securing and establishing trusted communication across Edge Deployments. Traceable uses TLS certificates to secure HTTPS traffic between clients, services, and edge environments, with integration into AWS Certificate Manager (ACM) for automated provisioning and renewal.
What will you learn in this topic?
By the end of this topic, you will be able to:
Understand TLS certificate management in Traceable.
Differentiate between auto and hosted certificate approaches.
Create, configure, and manage TLS certificates.
Validate domains and manage certificate lifecycle events.
Understand TLS certificates
Before you configure TLS certificates, make sure you understand when to use them, why, and how to leverage each certificate approach in Traceable. The following table explains the need and usage of TLS certificates:
Why use it? | When to use? | How to leverage it? |
|---|---|---|
TLS certificates secure HTTPS communication between clients and your edge cluster by encrypting traffic, validating domain ownership, and establishing the identity of the service. Without a valid TLS certificate, production-grade secure communication is not possible. Traceable uses AWS Certificate Manager (ACM) to provision and manage RSA and ECDSA certificates. | You can use TLS certificates when deploying Traceable in production to enable HTTPS-based communication between clients and services or to meet security and compliance requirements that mandate encrypted, authenticated traffic at the edge. They are essential whenever Edge Cluster communication must be protected and trusted. | You can use auto certificates for a simplified, fully managed TLS experience where Traceable and AWS (ACM) automatically handle certificate provisioning, validation, renewal, and lifecycle management. You can use hosted certificates when you require custom certificate workflows, external certificate authorities, or full control over certificate issuance, rotation, and renewal processes. |
Before you begin
Before you configure TLS certificates, make a note of the following:
AWS Certificate Manager supports specific cryptographic algorithms, including RSA 1024/2048/3072 and ECDSA 256/384/521. For more information, see Supported key algorithms and AWS key algorithms.
Auto certificates only
Ensure a valid domain is available with the ability to create and manage DNS records for domain validation.
Ensure AWS Certificate Manager (ACM) is supported in the selected region for automated provisioning, validation, and renewal.
Ensure DNS validation records remain unchanged after creation to support successful certificate renewal.
Hosted certificates only
You have a valid certificate issued by a trusted certificate authority.
You have access to the certificate private key and body in the required PEM format for import. For more information, see AWS Certificate Manager and Certificate and Key Format for Importing.
Certificate management approaches
Traceable supports the following certificate management approaches to secure HTTPS communication:
Auto certificates — Auto certificates simplify TLS management by automatically handling certificate provisioning, domain validation, renewal, and lifecycle operations via integration with AWS Certificate Manager (ACM).
Hosted certificates — Hosted certificates provide an externally managed certificate approach that requires full control over certificate issuance, rotation, and renewal processes.
.png)
TLS Certificates View Page
The following table compares the different certificate approaches, outlining their behavior and key differences across provisioning, validation, and renewal. It helps you understand the appropriate use of each option and select the most suitable option based on your deployment, security, and operational requirements:
Certificate Type → Comparison Metric ↓ | Hosted | Auto |
|---|---|---|
What it is | You generate the certificate externally through a certificate authority and upload it to Traceable. You are responsible for managing and renewing the certificate. | Traceable integrates with AWS Certificate Manager (ACM) to automatically provision, validate, renew, and manage certificates for supported Edge Deployments. You provide the name and domains, and Traceable manages it. |
DNS validation | Not required | You are required to add DNS records to your provider to prove domain ownership. |
Renewal | You are responsible for manually renewing and re-uploading before expiry. | AWS automatically initiates renewal 60 days before expiry. |
When to use | You use certificates issued by a required certificate authority that follows strict governance policies, or you need to import existing certificates into Traceable. | You want a zero-maintenance, fully automated certificate lifecycle without managing files or renewal schedules externally. |
Configure TLS certificate types
TLS certificate configuration determines how certificates are provisioned, validated, renewed, and managed across your edge deployments. The following tab discusses each certificate type in detail, helping you clearly understand how certificates work and how to configure them effectively according to your deployment needs:
Hosted certificates allow you to import an existing TLS certificate and private key into Traceable. After upload, the certificate becomes available for TLS configuration and attachment to supported Edge Cluster deployments.
To add a new certificate for the hosted type, click +New Certificate, and in the New Certificate slide-out panel, complete the following details:
Certificate Type — The certificate type you wish to use. In this example, you should select Hosted.
Name — A unique name for your certificate, for example, cert_upload.
Certificate Private Key — A private certificate key in the specified PEM encoded format. For more information, see Before you begin.
Certificate Body — A private certificate body in the specified PEM encoded format. For more information, see Before you begin.
Certificate Chain (Optional) — A chain of all certificates except the last one.
AWS Region(s) — The AWS Region that matches your edge cluster region from the drop-down, according to your requirements. For more information on the available regions, see AWS Regions Documentation.
Note
Make sure you select the same AWS region as selected here, for the Primary AWS Region and the (optional) Secondary AWS Region under the Add New Edge Cluster for deployment. For more information, see Edge Cluster Deployment.
Tags — Tags or labels comprising the Key and Value fields that contain any additional information or references related to the certificate, for example, Key as environment and Value as production.
Once all the necessary information is provided, the Upload button is enabled.
Note
Traceable sends an expiry notification 7 days before expiry.
Additionally, you can view or update existing certificates by clicking the Ellipse icon ( 
) next to the certificate you wish to view or update.
Auto certificates enable certificate provisioning through AWS Certificate Manager (ACM). After you create the certificate and complete domain validation, Traceable automatically manages certificate activation and renewal. You can complete DNS validation by adding the required records to your DNS provider. Once DNS validation succeeds, the certificate moves to Active status and is ready for use. After activation, Traceable automatically applies the TLS certificate configuration across supported environments without requiring manual intervention.
To add a new certificate for auto type, click +New Certificate, and in the New Certificate slide-out panel, complete the following steps:
.png)
Auto Certificate Addition
Certificate Type — The certificate type you wish to use. In this example, you should select Auto.
Name — A unique name for your certificate, for example, cert_upload.
Key Algorithm — An algorithm associated with your certificate from the drop-down. You can choose RSA_2048, EC_prime256v1, or EC_secp384r1 according to your requirements. For more information, see Supported Key Algorithms.
Domain — Domain(s) associated with your certificate in the DNS in the specified format.
AWS Region — The AWS region that matches your edge cluster's primary and secondary regions from the drop-down according to your requirements. For more information on the available regions, see AWS Regions Documentation.
Note
Make sure you select the same AWS region as selected here, for the Primary AWS Region and the (optional) Secondary AWS Region under the Add New Edge Cluster for deployment. For more information, see Edge Cluster Deployment.
Tags (Optional) — Tags or labels comprising the Key and Value fields that contain any additional information or references related to the certificate, for example, Key as Environment and Value as Production.
Once you provide all the necessary information, Upload is enabled.
Domain validation
After uploading your certificate, you must prove ownership of your domains before the certificate becomes active. To validate your domain in your DNS provider, complete the following steps:
.png)
DNS Records
Click the Ellipse (
) icon on the corresponding certificate, and click DNS Records.Copy the DNS record values displayed, such as Domain Name and Record Value.
Log in to your DNS provider and add these records.
Return to the certificate page and click Validate.
Once your DNS provider propagates the records and validation succeeds, the certificate status changes to Active.
Note
DNS propagation time depends on the DNS provider. If validation is still in progress after adding the records, wait a few minutes before retrying the Validate action.
Certificate renewal
AWS automatically starts the renewal process 60 days before certificate expiry to ensure uninterrupted HTTPS communication across your Edge Deployments. In most cases, no manual action is required after the initial setup, provided the DNS validation records created during certificate validation remain unchanged and accessible. During the renewal process, AWS verifies that the domain ownership records still exist and match the original validation configuration. The following section explains how certificate renewal behaves during DNS validation, including the expected behavior when validation succeeds and the actions required when it fails:
Validation succeeds — If the DNS validation succeeds, the certificate is automatically renewed without affecting traffic or existing TLS configurations. When renewal completes successfully, the certificate remains in the Active state, and Traceable sends a notification with the updated expiry details.
Validation fails — If the DNS validation records were modified, deleted, or are no longer accessible after the initial setup, AWS cannot verify domain ownership during renewal. In this case, the certificate transitions to the Renewal Pending state, and Traceable sends a notification indicating that corrective action is required. To re-validate the certificate, complete the following steps:
Click the Ellipse (
) icon on the corresponding certificate and click DNS records.Reconfigure the required DNS records in your DNS provider.
Click Validate, or wait up to 24 hours for automatic re-validation.
If the DNS records are not restored before the certificate expiry date, the renewal process fails, and the certificate status changes to Renewal Failed. At this point, the certificate is no longer valid until expiry. For secure HTTPS communication, you must create a new certificate and complete domain validation again, as discussed above.
Certificate statuses
Auto certificates move through different lifecycle states based on validation, activation, expiry, and renewal progress. The following table describes the different certificate statuses and their behavior throughout the certificate lifecycle:
Status | Description |
|---|---|
Pending | The certificate has been created and is waiting for DNS validation. |
Active | The certificate is validated, active, and ready for use with edge clusters. |
Expired | The certificate has expired and is no longer valid for secure communication. |
Failed | Certificate creation or DNS validation did not complete successfully. |
Renewal Pending | Renewal is in progress, but cannot be completed because the required DNS validation records are missing or incorrect. |
Renewal Failed | The certificate renewal was not completed before expiry, so the certificate must be recreated and revalidated. |
Note
DNS records are visible and editable only when an auto certificate is in Pending or Renewal pending status.
If DNS records are not restored before expiry, renewal fails and the status changes to Renewal Failed, requiring you to create a new certificate and re-validate the domain.
Once uploaded, the certificate is immediately available for attachment to your edge cluster.
Caveats
AWS Certificate Manager (ACM) has the following constraints:
ACM requires a Private Certificate Key with a minimum size of 2048 bits. For more information on key size, see ACM Certificate RSA Check.
Region mismatch between a certificate and an edge cluster prevents attachment. Ensure the certificate region matches the edge cluster region before you create the certificate.
Notifications
Traceable enables you to configure notifications for TLS certificate events, including configuration changes, expiry reminders, and renewal updates, to stay informed about certificate lifecycle activity. To create a notification for your channel, navigate to Settings → Notifications and configure the events you want to receive according to your requirements. For more information, see Notification.
Traceable provides different fields and event types for each event category. For example, the certificate configuration change category includes events such as create, update, renew, and expiry. For more information, see Notification Event Type and Field Definition.
FAQs
Does Traceable support HTTP-based domain validation for auto certificates?
No. Traceable supports only DNS-based validation for auto certificates through AWS Certificate Manager (ACM). HTTP-based validation is not supported.
Are the generated certificates publicly trusted?
Yes. Auto certificates use AWS Certificate Manager (ACM) public certificates, which are signed by AWS's public certificate authority and trusted by major browsers and operating systems.
Can the same ACM certificate ARN be reused across multiple Edge Clusters?
Yes, provided the certificate domains, AWS region, and deployment requirements align with each edge cluster configuration.
When does AWS start the certificate renewal process?
AWS Certificate Manager (ACM) automatically starts the renewal process approximately 60 days before certificate expiry. During renewal, ACM verifies that the required domain validation records are still present and valid. If validation succeeds, the certificate is renewed automatically without affecting existing TLS configurations or traffic.