Single service comparison

ACM is a single AWS service covering both public (DV/OV/EV) and private certificates via AWS Private CA, with tight coupling that auto-deploys certificates to AWS-owned endpoints (ELB, CloudFront, API Gateway) and performs automated renewal without operator intervention. Huawei splits this across CCM's two modules, SCM and PCA, which are managed together in one product but addressed through separate console areas and APIs. ACM's binding model replaces private key handling on AWS resources, whereas CCM SCM deployment centers on uploading/pushing certificates to Huawei endpoints such as ELB and WAF via deployment actions, so the integration surface differs per resource.

ACM exposes certificate resources, validators (DNS/HTTP/email), and the AWS Private CA hierarchy through the AWS Certificate Manager API and CloudFormation, with cross-account and cross-region sharing being limited and resource-specific. Huawei CCM's PCA manages a CA hierarchy and private certificate lifecycle through its own REST API and Identity and Access Management scoping, with quota and regional constraints documented per CA and per certificate type. Validation flows are not identical: ACM performs automated DNS validation against Route 53, while SCM coordinates validation with integrated CAs and supports uploading third-party certificates, which changes the operational responsibility and the automation tooling required.

Integration and operational responsibility diverge: ACM's renewal automation only applies to certificates attached to supported AWS services, leaving imported certificates without managed renewal, while PKI governance for private hierarchies lives in AWS Private CA with separate billing. CCM unifies SCM and PCA under Cloud Certificate Manager and pairs with KMS/DEW for key material and with ELB, WAF, and CDN for deployment, but automated renewal and redeployment coverage, supported resource types, and billing (per certificate, per CA, per hierarchy) must be validated per service and region rather than assumed equivalent.

Start by inventorying ACM public and private certificates, their attachment points (ELB, CloudFront, API Gateway, App Mesh), validation methods, renewal state, tagging, and Private CA hierarchies. For the public TLS workloads, target CCM SCM; for internal PKI and private certificates, target CCM PCA. Record each certificate's SANs, key algorithm, validity period, and consuming services, because Huawei ELB/WAF/CDN deployment bindings and supported certificate attributes do not map one-to-one with AWS resources and must be confirmed per endpoint.

Plan the certificate and CA migration rather than a data migration. Re-issue public certificates through CCM SCM with a CA approved for your target Huawei regions, or upload existing certificates where re-issue is not possible; recreate Private CA hierarchies in CCM PCA and re-issue private certificates to workloads. There is no automated AWS-to-Huawei certificate migration tool, so build the transfer with CCM APIs and IaC, and decommission ACM-issued certificates only after Huawei-issued replacements are deployed and validated on the consuming resources.

Validate before cutover by deploying each new CCM certificate to its Huawei resource (ELB, WAF, CDN, API Gateway), completing TLS handshakes, checking SAN coverage, chain validity, OCSP/CRL behavior, and renewal and alerting configuration. Confirm automated renewal eligibility per resource, since CCM's renewal and redeployment model is not uniformly identical to ACM's, and set Cloud Eye and CTS alarms for expiring certificates. Cut over one endpoint family at a time, then revoke and remove the corresponding ACM certificate and, where applicable, the AWS Private CA.

Account for governance and cost differences. ACM bills private CA instances hourly plus per-issued private certificate and charges separately for managed renewal behavior on AWS resources, while CCM SCM and PCA follow per-certificate and per-CA pricing that varies by certificate type and region, with DEW/KMS key usage added for key protection. Recompute TCO across the validity period, hierarchy depth, and number of certificates, and adjust IAM policies and PKI controls to CCM, IAM, and KMS equivalents rather than assuming AWS IAM and resource policies transfer directly.