You have your domain (Route 53) and your fast content (CloudFront). Something essential is still missing: your site must be secure, using HTTPS. For that, you need an SSL/TLS certificate, and AWS gives them to you for free with ACM (AWS Certificate Manager). In this subchapter, you'll understand what they are and how they simplify security.

You may have noticed that websites start with http:// or https://, and that browsers show a padlock for secure ones. The difference:

• HTTP: communication between the user and the server travels unencrypted. Anyone "listening" to the network (on public wifi, for example) could read what's being sent: passwords, card data, messages...
• HTTPS: communication is encrypted. Even if someone intercepts it, they only see unreadable data. It's HTTP + encryption.

Today HTTPS is not optional. Browsers mark HTTP sites as "not secure," Google penalizes their ranking, and users distrust a site without a padlock. Every website must use HTTPS.

For HTTPS to work, the server needs an SSL/TLS certificate. This certificate serves two purposes:

1. Enables encryption: allows the encrypted connection between user and server.
2. Verifies identity: proves that the site is who it claims to be (that mybank.com is really the bank, not an impostor). It's issued by a trusted authority.

Analogy: an SSL certificate is like your website's official ID card, issued by a recognized authority. When the browser sees it, it trusts that you're talking to the real site and opens a "private channel" (encrypted) for the conversation. Without a certificate, there's no padlock or secure channel.

In the past, obtaining and maintaining certificates was a hassle:

• You had to buy them (they cost money).
• Install them manually on the server (a technical and error-prone process).
• Renew them periodically (they expire), and if you forgot, your site would stop working with a security warning! This has taken down big company websites due to a simple oversight.

ACM eliminates all those problems. It's the AWS service that issues and manages SSL/TLS certificates, with three major advantages:

ACM certificates for use with AWS services are completely free. You pay nothing for the certificate.

ACM automatically renews certificates before they expire. You'll never have to worry about your site losing its padlock due to forgetfulness. This is perhaps the biggest relief: goodbye to scares from expired certificates.

ACM integrates directly with services that face the internet:

• CloudFront (subchapter 16.2).
• Application Load Balancer (Chapter 13).
• API Gateway (Chapter 14).

You associate the certificate with these services with a couple of clicks (or a few lines of Terraform), and they handle the encryption. You don't touch servers or install anything manually.

The typical flow is very simple:

1. Request a certificate in ACM for your domain (e.g. mywebsite.com).
2. Validate that the domain is yours (usually by adding a DNS record in Route 53; ACM and Route 53 integrate to make this almost automatic).
3. Associate the certificate with your CloudFront, load balancer, or API Gateway.
4. Done: your site serves HTTPS, and ACM renews the certificate by itself forever.

Detail to remember: certificates for CloudFront must be created in the Northern Virginia region (us-east-1), due to a technical peculiarity of how CloudFront works. It's a common oversight: if your certificate doesn't appear when configuring CloudFront, check that you created it in that region.

• HTTPS is encrypted HTTP: it protects data (passwords, payments) from prying eyes and shows the padlock. Today it's mandatory for any serious website.
• HTTPS needs an SSL/TLS certificate, which encrypts the connection and verifies the site's identity.
• ACM (AWS Certificate Manager) issues and manages certificates with three advantages: free, automatic renewal (no more scares from expiration), and automatic integration with CloudFront, load balancers, and API Gateway.
• Flow: request → validate the domain (via DNS/Route 53) → associate the certificate with the service → ACM renews it automatically.
• For CloudFront, create the certificate in the us-east-1 (Northern Virginia) region.

In the last subchapter of the chapter, we'll add a layer of protection to your site: the WAF application firewall, integrated with CloudFront.