diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
 
 ## Version
 
-`1.4.0`
+`1.4.1`
 
 
 ## Description
diff --git a/amazonka-certificatemanager.cabal b/amazonka-certificatemanager.cabal
--- a/amazonka-certificatemanager.cabal
+++ b/amazonka-certificatemanager.cabal
@@ -1,5 +1,5 @@
 name:                  amazonka-certificatemanager
-version:               1.4.0
+version:               1.4.1
 synopsis:              Amazon Certificate Manager SDK.
 homepage:              https://github.com/brendanhay/amazonka
 bug-reports:           https://github.com/brendanhay/amazonka/issues
@@ -51,10 +51,13 @@
 
     exposed-modules:
           Network.AWS.CertificateManager
+        , Network.AWS.CertificateManager.AddTagsToCertificate
         , Network.AWS.CertificateManager.DeleteCertificate
         , Network.AWS.CertificateManager.DescribeCertificate
         , Network.AWS.CertificateManager.GetCertificate
         , Network.AWS.CertificateManager.ListCertificates
+        , Network.AWS.CertificateManager.ListTagsForCertificate
+        , Network.AWS.CertificateManager.RemoveTagsFromCertificate
         , Network.AWS.CertificateManager.RequestCertificate
         , Network.AWS.CertificateManager.ResendValidationEmail
         , Network.AWS.CertificateManager.Types
@@ -65,7 +68,7 @@
         , Network.AWS.CertificateManager.Types.Sum
 
     build-depends:
-          amazonka-core == 1.4.0.*
+          amazonka-core == 1.4.1.*
         , base          >= 4.7     && < 5
 
 test-suite amazonka-certificatemanager-test
@@ -85,9 +88,9 @@
         , Test.AWS.CertificateManager.Internal
 
     build-depends:
-          amazonka-core == 1.4.0.*
-        , amazonka-test == 1.4.0.*
-        , amazonka-certificatemanager == 1.4.0.*
+          amazonka-core == 1.4.1.*
+        , amazonka-test == 1.4.1.*
+        , amazonka-certificatemanager == 1.4.1.*
         , base
         , bytestring
         , tasty
diff --git a/fixture/AddTagsToCertificate.yaml b/fixture/AddTagsToCertificate.yaml
new file mode 100644
--- /dev/null
+++ b/fixture/AddTagsToCertificate.yaml
diff --git a/fixture/AddTagsToCertificateResponse.proto b/fixture/AddTagsToCertificateResponse.proto
new file mode 100644
--- /dev/null
+++ b/fixture/AddTagsToCertificateResponse.proto
diff --git a/fixture/ListTagsForCertificate.yaml b/fixture/ListTagsForCertificate.yaml
new file mode 100644
--- /dev/null
+++ b/fixture/ListTagsForCertificate.yaml
diff --git a/fixture/ListTagsForCertificateResponse.proto b/fixture/ListTagsForCertificateResponse.proto
new file mode 100644
--- /dev/null
+++ b/fixture/ListTagsForCertificateResponse.proto
diff --git a/fixture/RemoveTagsFromCertificate.yaml b/fixture/RemoveTagsFromCertificate.yaml
new file mode 100644
--- /dev/null
+++ b/fixture/RemoveTagsFromCertificate.yaml
diff --git a/fixture/RemoveTagsFromCertificateResponse.proto b/fixture/RemoveTagsFromCertificateResponse.proto
new file mode 100644
--- /dev/null
+++ b/fixture/RemoveTagsFromCertificateResponse.proto
diff --git a/gen/Network/AWS/CertificateManager.hs b/gen/Network/AWS/CertificateManager.hs
--- a/gen/Network/AWS/CertificateManager.hs
+++ b/gen/Network/AWS/CertificateManager.hs
@@ -30,9 +30,15 @@
     -- * Errors
     -- $errors
 
+    -- ** InvalidTagException
+    , _InvalidTagException
+
     -- ** InvalidDomainValidationOptionsException
     , _InvalidDomainValidationOptionsException
 
+    -- ** TooManyTagsException
+    , _TooManyTagsException
+
     -- ** RequestInProgressException
     , _RequestInProgressException
 
@@ -60,9 +66,15 @@
     -- ** ResendValidationEmail
     , module Network.AWS.CertificateManager.ResendValidationEmail
 
+    -- ** ListTagsForCertificate
+    , module Network.AWS.CertificateManager.ListTagsForCertificate
+
     -- ** GetCertificate
     , module Network.AWS.CertificateManager.GetCertificate
 
+    -- ** AddTagsToCertificate
+    , module Network.AWS.CertificateManager.AddTagsToCertificate
+
     -- ** RequestCertificate
     , module Network.AWS.CertificateManager.RequestCertificate
 
@@ -72,6 +84,9 @@
     -- ** DeleteCertificate
     , module Network.AWS.CertificateManager.DeleteCertificate
 
+    -- ** RemoveTagsFromCertificate
+    , module Network.AWS.CertificateManager.RemoveTagsFromCertificate
+
     -- ** DescribeCertificate
     , module Network.AWS.CertificateManager.DescribeCertificate
 
@@ -125,12 +140,21 @@
     , domainValidationOption
     , dvoDomainName
     , dvoValidationDomain
+
+    -- ** Tag
+    , Tag
+    , tag
+    , tagValue
+    , tagKey
     ) where
 
+import           Network.AWS.CertificateManager.AddTagsToCertificate
 import           Network.AWS.CertificateManager.DeleteCertificate
 import           Network.AWS.CertificateManager.DescribeCertificate
 import           Network.AWS.CertificateManager.GetCertificate
 import           Network.AWS.CertificateManager.ListCertificates
+import           Network.AWS.CertificateManager.ListTagsForCertificate
+import           Network.AWS.CertificateManager.RemoveTagsFromCertificate
 import           Network.AWS.CertificateManager.RequestCertificate
 import           Network.AWS.CertificateManager.ResendValidationEmail
 import           Network.AWS.CertificateManager.Types
diff --git a/gen/Network/AWS/CertificateManager/AddTagsToCertificate.hs b/gen/Network/AWS/CertificateManager/AddTagsToCertificate.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/AddTagsToCertificate.hs
@@ -0,0 +1,144 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}
+{-# OPTIONS_GHC -fno-warn-unused-matches #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.AddTagsToCertificate
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Adds one or more tags to an ACM Certificate. Tags are labels that you
+-- can use to identify and organize your AWS resources. Each tag consists
+-- of a 'key' and an optional 'value'. You specify the certificate on input
+-- by its Amazon Resource Name (ARN). You specify the tag by using a
+-- key-value pair.
+--
+-- You can apply a tag to just one certificate if you want to identify a
+-- specific characteristic of that certificate, or you can apply the same
+-- tag to multiple certificates if you want to filter for a common
+-- relationship among those certificates. Similarly, you can apply the same
+-- tag to multiple resources if you want to specify a relationship among
+-- those resources. For example, you can add the same tag to an ACM
+-- Certificate and an Elastic Load Balancing load balancer to indicate that
+-- they are both used by the same website. For more information, see
+-- <http://docs.aws.amazon.com/acm/latest/userguide/tags.html Tagging ACM Certificates>.
+--
+-- To remove one or more tags, use the < RemoveTagsFromCertificate> action.
+-- To view all of the tags that have been applied to the certificate, use
+-- the < ListTagsForCertificate> action.
+module Network.AWS.CertificateManager.AddTagsToCertificate
+    (
+    -- * Creating a Request
+      addTagsToCertificate
+    , AddTagsToCertificate
+    -- * Request Lenses
+    , attcCertificateARN
+    , attcTags
+
+    -- * Destructuring the Response
+    , addTagsToCertificateResponse
+    , AddTagsToCertificateResponse
+    ) where
+
+import           Network.AWS.CertificateManager.Types
+import           Network.AWS.CertificateManager.Types.Product
+import           Network.AWS.Lens
+import           Network.AWS.Prelude
+import           Network.AWS.Request
+import           Network.AWS.Response
+
+-- |
+--
+-- /See:/ 'addTagsToCertificate' smart constructor.
+data AddTagsToCertificate = AddTagsToCertificate'
+    { _attcCertificateARN :: !Text
+    , _attcTags           :: !(List1 Tag)
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'AddTagsToCertificate' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'attcCertificateARN'
+--
+-- * 'attcTags'
+addTagsToCertificate
+    :: Text -- ^ 'attcCertificateARN'
+    -> NonEmpty Tag -- ^ 'attcTags'
+    -> AddTagsToCertificate
+addTagsToCertificate pCertificateARN_ pTags_ =
+    AddTagsToCertificate'
+    { _attcCertificateARN = pCertificateARN_
+    , _attcTags = _List1 # pTags_
+    }
+
+-- | String that contains the ARN of the ACM Certificate to which the tag is
+-- to be applied. This must be of the form:
+--
+-- 'arn:aws:acm:region:123456789012:certificate\/12345678-1234-1234-1234-123456789012'
+--
+-- For more information about ARNs, see
+-- <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Names (ARNs) and AWS Service Namespaces>.
+attcCertificateARN :: Lens' AddTagsToCertificate Text
+attcCertificateARN = lens _attcCertificateARN (\ s a -> s{_attcCertificateARN = a});
+
+-- | The key-value pair that defines the tag. The tag value is optional.
+attcTags :: Lens' AddTagsToCertificate (NonEmpty Tag)
+attcTags = lens _attcTags (\ s a -> s{_attcTags = a}) . _List1;
+
+instance AWSRequest AddTagsToCertificate where
+        type Rs AddTagsToCertificate =
+             AddTagsToCertificateResponse
+        request = postJSON certificateManager
+        response = receiveNull AddTagsToCertificateResponse'
+
+instance Hashable AddTagsToCertificate
+
+instance NFData AddTagsToCertificate
+
+instance ToHeaders AddTagsToCertificate where
+        toHeaders
+          = const
+              (mconcat
+                 ["X-Amz-Target" =#
+                    ("CertificateManager.AddTagsToCertificate" ::
+                       ByteString),
+                  "Content-Type" =#
+                    ("application/x-amz-json-1.1" :: ByteString)])
+
+instance ToJSON AddTagsToCertificate where
+        toJSON AddTagsToCertificate'{..}
+          = object
+              (catMaybes
+                 [Just ("CertificateArn" .= _attcCertificateARN),
+                  Just ("Tags" .= _attcTags)])
+
+instance ToPath AddTagsToCertificate where
+        toPath = const "/"
+
+instance ToQuery AddTagsToCertificate where
+        toQuery = const mempty
+
+-- | /See:/ 'addTagsToCertificateResponse' smart constructor.
+data AddTagsToCertificateResponse =
+    AddTagsToCertificateResponse'
+    deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'AddTagsToCertificateResponse' with the minimum fields required to make a request.
+--
+addTagsToCertificateResponse
+    :: AddTagsToCertificateResponse
+addTagsToCertificateResponse = AddTagsToCertificateResponse'
+
+instance NFData AddTagsToCertificateResponse
diff --git a/gen/Network/AWS/CertificateManager/DeleteCertificate.hs b/gen/Network/AWS/CertificateManager/DeleteCertificate.hs
--- a/gen/Network/AWS/CertificateManager/DeleteCertificate.hs
+++ b/gen/Network/AWS/CertificateManager/DeleteCertificate.hs
@@ -47,7 +47,9 @@
 import           Network.AWS.Request
 import           Network.AWS.Response
 
--- | /See:/ 'deleteCertificate' smart constructor.
+-- |
+--
+-- /See:/ 'deleteCertificate' smart constructor.
 newtype DeleteCertificate = DeleteCertificate'
     { _dcCertificateARN :: Text
     } deriving (Eq,Read,Show,Data,Typeable,Generic)
@@ -82,6 +84,8 @@
 
 instance Hashable DeleteCertificate
 
+instance NFData DeleteCertificate
+
 instance ToHeaders DeleteCertificate where
         toHeaders
           = const
@@ -114,3 +118,5 @@
 deleteCertificateResponse
     :: DeleteCertificateResponse
 deleteCertificateResponse = DeleteCertificateResponse'
+
+instance NFData DeleteCertificateResponse
diff --git a/gen/Network/AWS/CertificateManager/DescribeCertificate.hs b/gen/Network/AWS/CertificateManager/DescribeCertificate.hs
--- a/gen/Network/AWS/CertificateManager/DescribeCertificate.hs
+++ b/gen/Network/AWS/CertificateManager/DescribeCertificate.hs
@@ -21,8 +21,8 @@
 -- Returns a list of the fields contained in the specified ACM Certificate.
 -- For example, this action returns the certificate status, a flag that
 -- indicates whether the certificate is associated with any other AWS
--- service, and the date at which the certificate request was created. The
--- ACM Certificate is specified on input by its Amazon Resource Name (ARN).
+-- service, and the date at which the certificate request was created. You
+-- specify the ACM Certificate on input by its Amazon Resource Name (ARN).
 module Network.AWS.CertificateManager.DescribeCertificate
     (
     -- * Creating a Request
@@ -46,7 +46,9 @@
 import           Network.AWS.Request
 import           Network.AWS.Response
 
--- | /See:/ 'describeCertificate' smart constructor.
+-- |
+--
+-- /See:/ 'describeCertificate' smart constructor.
 newtype DescribeCertificate = DescribeCertificate'
     { _dCertificateARN :: Text
     } deriving (Eq,Read,Show,Data,Typeable,Generic)
@@ -86,6 +88,8 @@
 
 instance Hashable DescribeCertificate
 
+instance NFData DescribeCertificate
+
 instance ToHeaders DescribeCertificate where
         toHeaders
           = const
@@ -108,7 +112,9 @@
 instance ToQuery DescribeCertificate where
         toQuery = const mempty
 
--- | /See:/ 'describeCertificateResponse' smart constructor.
+-- |
+--
+-- /See:/ 'describeCertificateResponse' smart constructor.
 data DescribeCertificateResponse = DescribeCertificateResponse'
     { _dcrsCertificate    :: !(Maybe CertificateDetail)
     , _dcrsResponseStatus :: !Int
@@ -138,3 +144,5 @@
 -- | The response status code.
 dcrsResponseStatus :: Lens' DescribeCertificateResponse Int
 dcrsResponseStatus = lens _dcrsResponseStatus (\ s a -> s{_dcrsResponseStatus = a});
+
+instance NFData DescribeCertificateResponse
diff --git a/gen/Network/AWS/CertificateManager/GetCertificate.hs b/gen/Network/AWS/CertificateManager/GetCertificate.hs
--- a/gen/Network/AWS/CertificateManager/GetCertificate.hs
+++ b/gen/Network/AWS/CertificateManager/GetCertificate.hs
@@ -51,7 +51,9 @@
 import           Network.AWS.Request
 import           Network.AWS.Response
 
--- | /See:/ 'getCertificate' smart constructor.
+-- |
+--
+-- /See:/ 'getCertificate' smart constructor.
 newtype GetCertificate = GetCertificate'
     { _gcCertificateARN :: Text
     } deriving (Eq,Read,Show,Data,Typeable,Generic)
@@ -90,6 +92,8 @@
 
 instance Hashable GetCertificate
 
+instance NFData GetCertificate
+
 instance ToHeaders GetCertificate where
         toHeaders
           = const
@@ -111,7 +115,9 @@
 instance ToQuery GetCertificate where
         toQuery = const mempty
 
--- | /See:/ 'getCertificateResponse' smart constructor.
+-- |
+--
+-- /See:/ 'getCertificateResponse' smart constructor.
 data GetCertificateResponse = GetCertificateResponse'
     { _gcrsCertificate      :: !(Maybe Text)
     , _gcrsCertificateChain :: !(Maybe Text)
@@ -150,3 +156,5 @@
 -- | The response status code.
 gcrsResponseStatus :: Lens' GetCertificateResponse Int
 gcrsResponseStatus = lens _gcrsResponseStatus (\ s a -> s{_gcrsResponseStatus = a});
+
+instance NFData GetCertificateResponse
diff --git a/gen/Network/AWS/CertificateManager/ListCertificates.hs b/gen/Network/AWS/CertificateManager/ListCertificates.hs
--- a/gen/Network/AWS/CertificateManager/ListCertificates.hs
+++ b/gen/Network/AWS/CertificateManager/ListCertificates.hs
@@ -51,7 +51,9 @@
 import           Network.AWS.Request
 import           Network.AWS.Response
 
--- | /See:/ 'listCertificates' smart constructor.
+-- |
+--
+-- /See:/ 'listCertificates' smart constructor.
 data ListCertificates = ListCertificates'
     { _lcCertificateStatuses :: !(Maybe [CertificateStatus])
     , _lcNextToken           :: !(Maybe Text)
@@ -80,12 +82,19 @@
 -- retrieve the ARNs. This can be one or more of the following values:
 --
 -- -   'PENDING_VALIDATION'
+--
 -- -   'ISSUED'
+--
 -- -   'INACTIVE'
+--
 -- -   'EXPIRED'
+--
 -- -   'VALIDATION_TIMED_OUT'
+--
 -- -   'REVOKED'
+--
 -- -   'FAILED'
+--
 lcCertificateStatuses :: Lens' ListCertificates [CertificateStatus]
 lcCertificateStatuses = lens _lcCertificateStatuses (\ s a -> s{_lcCertificateStatuses = a}) . _Default . _Coerce;
 
@@ -119,6 +128,8 @@
 
 instance Hashable ListCertificates
 
+instance NFData ListCertificates
+
 instance ToHeaders ListCertificates where
         toHeaders
           = const
@@ -144,7 +155,9 @@
 instance ToQuery ListCertificates where
         toQuery = const mempty
 
--- | /See:/ 'listCertificatesResponse' smart constructor.
+-- |
+--
+-- /See:/ 'listCertificatesResponse' smart constructor.
 data ListCertificatesResponse = ListCertificatesResponse'
     { _lcrsCertificateSummaryList :: !(Maybe [CertificateSummary])
     , _lcrsNextToken              :: !(Maybe Text)
@@ -183,3 +196,5 @@
 -- | The response status code.
 lcrsResponseStatus :: Lens' ListCertificatesResponse Int
 lcrsResponseStatus = lens _lcrsResponseStatus (\ s a -> s{_lcrsResponseStatus = a});
+
+instance NFData ListCertificatesResponse
diff --git a/gen/Network/AWS/CertificateManager/ListTagsForCertificate.hs b/gen/Network/AWS/CertificateManager/ListTagsForCertificate.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/ListTagsForCertificate.hs
@@ -0,0 +1,146 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}
+{-# OPTIONS_GHC -fno-warn-unused-matches #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.ListTagsForCertificate
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Lists the tags that have been applied to the ACM Certificate. Use the
+-- certificate ARN to specify the certificate. To add a tag to an ACM
+-- Certificate, use the < AddTagsToCertificate> action. To delete a tag,
+-- use the < RemoveTagsFromCertificate> action.
+module Network.AWS.CertificateManager.ListTagsForCertificate
+    (
+    -- * Creating a Request
+      listTagsForCertificate
+    , ListTagsForCertificate
+    -- * Request Lenses
+    , ltfcCertificateARN
+
+    -- * Destructuring the Response
+    , listTagsForCertificateResponse
+    , ListTagsForCertificateResponse
+    -- * Response Lenses
+    , ltfcrsTags
+    , ltfcrsResponseStatus
+    ) where
+
+import           Network.AWS.CertificateManager.Types
+import           Network.AWS.CertificateManager.Types.Product
+import           Network.AWS.Lens
+import           Network.AWS.Prelude
+import           Network.AWS.Request
+import           Network.AWS.Response
+
+-- |
+--
+-- /See:/ 'listTagsForCertificate' smart constructor.
+newtype ListTagsForCertificate = ListTagsForCertificate'
+    { _ltfcCertificateARN :: Text
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ListTagsForCertificate' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'ltfcCertificateARN'
+listTagsForCertificate
+    :: Text -- ^ 'ltfcCertificateARN'
+    -> ListTagsForCertificate
+listTagsForCertificate pCertificateARN_ =
+    ListTagsForCertificate'
+    { _ltfcCertificateARN = pCertificateARN_
+    }
+
+-- | String that contains the ARN of the ACM Certificate for which you want
+-- to list the tags. This must be of the form:
+--
+-- 'arn:aws:acm:region:123456789012:certificate\/12345678-1234-1234-1234-123456789012'
+--
+-- For more information about ARNs, see
+-- <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Names (ARNs) and AWS Service Namespaces>.
+ltfcCertificateARN :: Lens' ListTagsForCertificate Text
+ltfcCertificateARN = lens _ltfcCertificateARN (\ s a -> s{_ltfcCertificateARN = a});
+
+instance AWSRequest ListTagsForCertificate where
+        type Rs ListTagsForCertificate =
+             ListTagsForCertificateResponse
+        request = postJSON certificateManager
+        response
+          = receiveJSON
+              (\ s h x ->
+                 ListTagsForCertificateResponse' <$>
+                   (x .?> "Tags") <*> (pure (fromEnum s)))
+
+instance Hashable ListTagsForCertificate
+
+instance NFData ListTagsForCertificate
+
+instance ToHeaders ListTagsForCertificate where
+        toHeaders
+          = const
+              (mconcat
+                 ["X-Amz-Target" =#
+                    ("CertificateManager.ListTagsForCertificate" ::
+                       ByteString),
+                  "Content-Type" =#
+                    ("application/x-amz-json-1.1" :: ByteString)])
+
+instance ToJSON ListTagsForCertificate where
+        toJSON ListTagsForCertificate'{..}
+          = object
+              (catMaybes
+                 [Just ("CertificateArn" .= _ltfcCertificateARN)])
+
+instance ToPath ListTagsForCertificate where
+        toPath = const "/"
+
+instance ToQuery ListTagsForCertificate where
+        toQuery = const mempty
+
+-- |
+--
+-- /See:/ 'listTagsForCertificateResponse' smart constructor.
+data ListTagsForCertificateResponse = ListTagsForCertificateResponse'
+    { _ltfcrsTags           :: !(Maybe (List1 Tag))
+    , _ltfcrsResponseStatus :: !Int
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ListTagsForCertificateResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'ltfcrsTags'
+--
+-- * 'ltfcrsResponseStatus'
+listTagsForCertificateResponse
+    :: Int -- ^ 'ltfcrsResponseStatus'
+    -> ListTagsForCertificateResponse
+listTagsForCertificateResponse pResponseStatus_ =
+    ListTagsForCertificateResponse'
+    { _ltfcrsTags = Nothing
+    , _ltfcrsResponseStatus = pResponseStatus_
+    }
+
+-- | The key-value pairs that define the applied tags.
+ltfcrsTags :: Lens' ListTagsForCertificateResponse (Maybe (NonEmpty Tag))
+ltfcrsTags = lens _ltfcrsTags (\ s a -> s{_ltfcrsTags = a}) . mapping _List1;
+
+-- | The response status code.
+ltfcrsResponseStatus :: Lens' ListTagsForCertificateResponse Int
+ltfcrsResponseStatus = lens _ltfcrsResponseStatus (\ s a -> s{_ltfcrsResponseStatus = a});
+
+instance NFData ListTagsForCertificateResponse
diff --git a/gen/Network/AWS/CertificateManager/RemoveTagsFromCertificate.hs b/gen/Network/AWS/CertificateManager/RemoveTagsFromCertificate.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/AWS/CertificateManager/RemoveTagsFromCertificate.hs
@@ -0,0 +1,135 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}
+{-# OPTIONS_GHC -fno-warn-unused-matches #-}
+
+-- Derived from AWS service descriptions, licensed under Apache 2.0.
+
+-- |
+-- Module      : Network.AWS.CertificateManager.RemoveTagsFromCertificate
+-- Copyright   : (c) 2013-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Remove one or more tags from an ACM Certificate. A tag consists of a
+-- key-value pair. If you do not specify the value portion of the tag when
+-- calling this function, the tag will be removed regardless of value. If
+-- you specify a value, the tag is removed only if it is associated with
+-- the specified value.
+--
+-- To add tags to a certificate, use the < AddTagsToCertificate> action. To
+-- view all of the tags that have been applied to a specific ACM
+-- Certificate, use the < ListTagsForCertificate> action.
+module Network.AWS.CertificateManager.RemoveTagsFromCertificate
+    (
+    -- * Creating a Request
+      removeTagsFromCertificate
+    , RemoveTagsFromCertificate
+    -- * Request Lenses
+    , rtfcCertificateARN
+    , rtfcTags
+
+    -- * Destructuring the Response
+    , removeTagsFromCertificateResponse
+    , RemoveTagsFromCertificateResponse
+    ) where
+
+import           Network.AWS.CertificateManager.Types
+import           Network.AWS.CertificateManager.Types.Product
+import           Network.AWS.Lens
+import           Network.AWS.Prelude
+import           Network.AWS.Request
+import           Network.AWS.Response
+
+-- |
+--
+-- /See:/ 'removeTagsFromCertificate' smart constructor.
+data RemoveTagsFromCertificate = RemoveTagsFromCertificate'
+    { _rtfcCertificateARN :: !Text
+    , _rtfcTags           :: !(List1 Tag)
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'RemoveTagsFromCertificate' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'rtfcCertificateARN'
+--
+-- * 'rtfcTags'
+removeTagsFromCertificate
+    :: Text -- ^ 'rtfcCertificateARN'
+    -> NonEmpty Tag -- ^ 'rtfcTags'
+    -> RemoveTagsFromCertificate
+removeTagsFromCertificate pCertificateARN_ pTags_ =
+    RemoveTagsFromCertificate'
+    { _rtfcCertificateARN = pCertificateARN_
+    , _rtfcTags = _List1 # pTags_
+    }
+
+-- | String that contains the ARN of the ACM Certificate with one or more
+-- tags that you want to remove. This must be of the form:
+--
+-- 'arn:aws:acm:region:123456789012:certificate\/12345678-1234-1234-1234-123456789012'
+--
+-- For more information about ARNs, see
+-- <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Names (ARNs) and AWS Service Namespaces>.
+rtfcCertificateARN :: Lens' RemoveTagsFromCertificate Text
+rtfcCertificateARN = lens _rtfcCertificateARN (\ s a -> s{_rtfcCertificateARN = a});
+
+-- | The key-value pair that defines the tag to remove.
+rtfcTags :: Lens' RemoveTagsFromCertificate (NonEmpty Tag)
+rtfcTags = lens _rtfcTags (\ s a -> s{_rtfcTags = a}) . _List1;
+
+instance AWSRequest RemoveTagsFromCertificate where
+        type Rs RemoveTagsFromCertificate =
+             RemoveTagsFromCertificateResponse
+        request = postJSON certificateManager
+        response
+          = receiveNull RemoveTagsFromCertificateResponse'
+
+instance Hashable RemoveTagsFromCertificate
+
+instance NFData RemoveTagsFromCertificate
+
+instance ToHeaders RemoveTagsFromCertificate where
+        toHeaders
+          = const
+              (mconcat
+                 ["X-Amz-Target" =#
+                    ("CertificateManager.RemoveTagsFromCertificate" ::
+                       ByteString),
+                  "Content-Type" =#
+                    ("application/x-amz-json-1.1" :: ByteString)])
+
+instance ToJSON RemoveTagsFromCertificate where
+        toJSON RemoveTagsFromCertificate'{..}
+          = object
+              (catMaybes
+                 [Just ("CertificateArn" .= _rtfcCertificateARN),
+                  Just ("Tags" .= _rtfcTags)])
+
+instance ToPath RemoveTagsFromCertificate where
+        toPath = const "/"
+
+instance ToQuery RemoveTagsFromCertificate where
+        toQuery = const mempty
+
+-- | /See:/ 'removeTagsFromCertificateResponse' smart constructor.
+data RemoveTagsFromCertificateResponse =
+    RemoveTagsFromCertificateResponse'
+    deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'RemoveTagsFromCertificateResponse' with the minimum fields required to make a request.
+--
+removeTagsFromCertificateResponse
+    :: RemoveTagsFromCertificateResponse
+removeTagsFromCertificateResponse = RemoveTagsFromCertificateResponse'
+
+instance NFData RemoveTagsFromCertificateResponse
diff --git a/gen/Network/AWS/CertificateManager/RequestCertificate.hs b/gen/Network/AWS/CertificateManager/RequestCertificate.hs
--- a/gen/Network/AWS/CertificateManager/RequestCertificate.hs
+++ b/gen/Network/AWS/CertificateManager/RequestCertificate.hs
@@ -52,7 +52,9 @@
 import           Network.AWS.Request
 import           Network.AWS.Response
 
--- | /See:/ 'requestCertificate' smart constructor.
+-- |
+--
+-- /See:/ 'requestCertificate' smart constructor.
 data RequestCertificate = RequestCertificate'
     { _rcIdempotencyToken        :: !(Maybe Text)
     , _rcSubjectAlternativeNames :: !(Maybe (List1 Text))
@@ -108,10 +110,15 @@
 -- WHOIS and the following five addresses:
 --
 -- -   admin\'example.com
+--
 -- -   administrator\'example.com
+--
 -- -   hostmaster\'example.com
+--
 -- -   postmaster\'example.com
+--
 -- -   webmaster\'example.com
+--
 rcDomainValidationOptions :: Lens' RequestCertificate (Maybe (NonEmpty DomainValidationOption))
 rcDomainValidationOptions = lens _rcDomainValidationOptions (\ s a -> s{_rcDomainValidationOptions = a}) . mapping _List1;
 
@@ -135,6 +142,8 @@
 
 instance Hashable RequestCertificate
 
+instance NFData RequestCertificate
+
 instance ToHeaders RequestCertificate where
         toHeaders
           = const
@@ -162,7 +171,9 @@
 instance ToQuery RequestCertificate where
         toQuery = const mempty
 
--- | /See:/ 'requestCertificateResponse' smart constructor.
+-- |
+--
+-- /See:/ 'requestCertificateResponse' smart constructor.
 data RequestCertificateResponse = RequestCertificateResponse'
     { _rcrsCertificateARN :: !(Maybe Text)
     , _rcrsResponseStatus :: !Int
@@ -194,3 +205,5 @@
 -- | The response status code.
 rcrsResponseStatus :: Lens' RequestCertificateResponse Int
 rcrsResponseStatus = lens _rcrsResponseStatus (\ s a -> s{_rcrsResponseStatus = a});
+
+instance NFData RequestCertificateResponse
diff --git a/gen/Network/AWS/CertificateManager/ResendValidationEmail.hs b/gen/Network/AWS/CertificateManager/ResendValidationEmail.hs
--- a/gen/Network/AWS/CertificateManager/ResendValidationEmail.hs
+++ b/gen/Network/AWS/CertificateManager/ResendValidationEmail.hs
@@ -50,7 +50,9 @@
 import           Network.AWS.Request
 import           Network.AWS.Response
 
--- | /See:/ 'resendValidationEmail' smart constructor.
+-- |
+--
+-- /See:/ 'resendValidationEmail' smart constructor.
 data ResendValidationEmail = ResendValidationEmail'
     { _rveCertificateARN   :: !Text
     , _rveDomain           :: !Text
@@ -79,9 +81,9 @@
     }
 
 -- | String that contains the ARN of the requested certificate. The
--- certificate ARN is generated and returned by < RequestCertificate> as
--- soon as the request is made. By default, using this parameter causes
--- email to be sent to all top-level domains you specified in the
+-- certificate ARN is generated and returned by the < RequestCertificate>
+-- action as soon as the request is made. By default, using this parameter
+-- causes email to be sent to all top-level domains you specified in the
 -- certificate request.
 --
 -- The ARN must be of the form:
@@ -104,10 +106,15 @@
 -- WHOIS and the following five addresses:
 --
 -- -   admin\'subdomain.example.com
+--
 -- -   administrator\'subdomain.example.com
+--
 -- -   hostmaster\'subdomain.example.com
+--
 -- -   postmaster\'subdomain.example.com
+--
 -- -   webmaster\'subdomain.example.com
+--
 rveValidationDomain :: Lens' ResendValidationEmail Text
 rveValidationDomain = lens _rveValidationDomain (\ s a -> s{_rveValidationDomain = a});
 
@@ -119,6 +126,8 @@
 
 instance Hashable ResendValidationEmail
 
+instance NFData ResendValidationEmail
+
 instance ToHeaders ResendValidationEmail where
         toHeaders
           = const
@@ -153,3 +162,5 @@
 resendValidationEmailResponse
     :: ResendValidationEmailResponse
 resendValidationEmailResponse = ResendValidationEmailResponse'
+
+instance NFData ResendValidationEmailResponse
diff --git a/gen/Network/AWS/CertificateManager/Types.hs b/gen/Network/AWS/CertificateManager/Types.hs
--- a/gen/Network/AWS/CertificateManager/Types.hs
+++ b/gen/Network/AWS/CertificateManager/Types.hs
@@ -16,7 +16,9 @@
       certificateManager
 
     -- * Errors
+    , _InvalidTagException
     , _InvalidDomainValidationOptionsException
+    , _TooManyTagsException
     , _RequestInProgressException
     , _InvalidARNException
     , _ResourceNotFoundException
@@ -72,6 +74,12 @@
     , domainValidationOption
     , dvoDomainName
     , dvoValidationDomain
+
+    -- * Tag
+    , Tag
+    , tag
+    , tagValue
+    , tagKey
     ) where
 
 import           Network.AWS.CertificateManager.Types.Product
@@ -107,16 +115,28 @@
       | has (hasCode "ThrottlingException" . hasStatus 400) e =
           Just "throttling_exception"
       | has (hasCode "Throttling" . hasStatus 400) e = Just "throttling"
+      | has (hasStatus 504) e = Just "gateway_timeout"
+      | has (hasStatus 502) e = Just "bad_gateway"
       | has (hasStatus 503) e = Just "service_unavailable"
       | has (hasStatus 500) e = Just "general_server_error"
       | has (hasStatus 509) e = Just "limit_exceeded"
       | otherwise = Nothing
 
+-- | One or both of the values that make up the key-value pair is not valid.
+-- For example, you cannot specify a tag value that begins with 'aws:'.
+_InvalidTagException :: AsError a => Getting (First ServiceError) a ServiceError
+_InvalidTagException = _ServiceError . hasCode "InvalidTagException"
+
 -- | One or more values in the < DomainValidationOption> structure is
 -- incorrect.
 _InvalidDomainValidationOptionsException :: AsError a => Getting (First ServiceError) a ServiceError
 _InvalidDomainValidationOptionsException =
     _ServiceError . hasCode "InvalidDomainValidationOptionsException"
+
+-- | The request contains too many tags. Try the request again with fewer
+-- tags.
+_TooManyTagsException :: AsError a => Getting (First ServiceError) a ServiceError
+_TooManyTagsException = _ServiceError . hasCode "TooManyTagsException"
 
 -- | The certificate request is in process and the certificate in your
 -- account has not yet been issued.
diff --git a/gen/Network/AWS/CertificateManager/Types/Product.hs b/gen/Network/AWS/CertificateManager/Types/Product.hs
--- a/gen/Network/AWS/CertificateManager/Types/Product.hs
+++ b/gen/Network/AWS/CertificateManager/Types/Product.hs
@@ -114,12 +114,19 @@
 -- following:
 --
 -- -   PENDING_VALIDATION
+--
 -- -   ISSUED
+--
 -- -   INACTIVE
+--
 -- -   EXPIRED
+--
 -- -   REVOKED
+--
 -- -   FAILED
+--
 -- -   VALIDATION_TIMED_OUT
+--
 cdStatus :: Lens' CertificateDetail (Maybe CertificateStatus)
 cdStatus = lens _cdStatus (\ s a -> s{_cdStatus = a});
 
@@ -168,15 +175,25 @@
 -- been revoked. This can be one of the following vales:
 --
 -- -   UNSPECIFIED
+--
 -- -   KEY_COMPROMISE
+--
 -- -   CA_COMPROMISE
+--
 -- -   AFFILIATION_CHANGED
+--
 -- -   SUPERCEDED
+--
 -- -   CESSATION_OF_OPERATION
+--
 -- -   CERTIFICATE_HOLD
+--
 -- -   REMOVE_FROM_CRL
+--
 -- -   PRIVILEGE_WITHDRAWN
+--
 -- -   A_A_COMPROMISE
+--
 cdRevocationReason :: Lens' CertificateDetail (Maybe RevocationReason)
 cdRevocationReason = lens _cdRevocationReason (\ s a -> s{_cdRevocationReason = a});
 
@@ -238,6 +255,8 @@
 
 instance Hashable CertificateDetail
 
+instance NFData CertificateDetail
+
 -- | This structure is returned in the response object of < ListCertificates>
 -- action.
 --
@@ -285,6 +304,8 @@
 
 instance Hashable CertificateSummary
 
+instance NFData CertificateSummary
+
 -- | Structure that contains the domain name, the base validation domain to
 -- which validation email is sent, and the email addresses used to validate
 -- the domain identity.
@@ -340,6 +361,8 @@
 
 instance Hashable DomainValidation
 
+instance NFData DomainValidation
+
 -- | This structure is used in the request object of the
 -- < RequestCertificate> action.
 --
@@ -377,21 +400,77 @@
 -- 'site.subdomain.example.com' and specify a __ValidationDomain__ of
 -- 'subdomain.example.com', ACM sends email to the domain registrant,
 -- technical contact, and administrative contact in WHOIS for the base
--- domain and the and the following five addresses:
+-- domain and the following five addresses:
 --
 -- -   admin\'subdomain.example.com
+--
 -- -   administrator\'subdomain.example.com
+--
 -- -   hostmaster\'subdomain.example.com
+--
 -- -   postmaster\'subdomain.example.com
+--
 -- -   webmaster\'subdomain.example.com
+--
 dvoValidationDomain :: Lens' DomainValidationOption Text
 dvoValidationDomain = lens _dvoValidationDomain (\ s a -> s{_dvoValidationDomain = a});
 
 instance Hashable DomainValidationOption
 
+instance NFData DomainValidationOption
+
 instance ToJSON DomainValidationOption where
         toJSON DomainValidationOption'{..}
           = object
               (catMaybes
                  [Just ("DomainName" .= _dvoDomainName),
                   Just ("ValidationDomain" .= _dvoValidationDomain)])
+
+-- | A key-value pair that identifies or specifies metadata about an ACM
+-- resource.
+--
+-- /See:/ 'tag' smart constructor.
+data Tag = Tag'
+    { _tagValue :: !(Maybe Text)
+    , _tagKey   :: !Text
+    } deriving (Eq,Read,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'Tag' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'tagValue'
+--
+-- * 'tagKey'
+tag
+    :: Text -- ^ 'tagKey'
+    -> Tag
+tag pKey_ =
+    Tag'
+    { _tagValue = Nothing
+    , _tagKey = pKey_
+    }
+
+-- | The value of the tag.
+tagValue :: Lens' Tag (Maybe Text)
+tagValue = lens _tagValue (\ s a -> s{_tagValue = a});
+
+-- | The key of the tag.
+tagKey :: Lens' Tag Text
+tagKey = lens _tagKey (\ s a -> s{_tagKey = a});
+
+instance FromJSON Tag where
+        parseJSON
+          = withObject "Tag"
+              (\ x -> Tag' <$> (x .:? "Value") <*> (x .: "Key"))
+
+instance Hashable Tag
+
+instance NFData Tag
+
+instance ToJSON Tag where
+        toJSON Tag'{..}
+          = object
+              (catMaybes
+                 [("Value" .=) <$> _tagValue,
+                  Just ("Key" .= _tagKey)])
diff --git a/gen/Network/AWS/CertificateManager/Types/Sum.hs b/gen/Network/AWS/CertificateManager/Types/Sum.hs
--- a/gen/Network/AWS/CertificateManager/Types/Sum.hs
+++ b/gen/Network/AWS/CertificateManager/Types/Sum.hs
@@ -52,6 +52,7 @@
         ValidationTimedOut -> "VALIDATION_TIMED_OUT"
 
 instance Hashable     CertificateStatus
+instance NFData       CertificateStatus
 instance ToByteString CertificateStatus
 instance ToQuery      CertificateStatus
 instance ToHeader     CertificateStatus
@@ -80,6 +81,7 @@
         Rsa2048 -> "RSA_2048"
 
 instance Hashable     KeyAlgorithm
+instance NFData       KeyAlgorithm
 instance ToByteString KeyAlgorithm
 instance ToQuery      KeyAlgorithm
 instance ToHeader     KeyAlgorithm
@@ -129,6 +131,7 @@
         Unspecified -> "UNSPECIFIED"
 
 instance Hashable     RevocationReason
+instance NFData       RevocationReason
 instance ToByteString RevocationReason
 instance ToQuery      RevocationReason
 instance ToHeader     RevocationReason
diff --git a/test/Test/AWS/Gen/CertificateManager.hs b/test/Test/AWS/Gen/CertificateManager.hs
--- a/test/Test/AWS/Gen/CertificateManager.hs
+++ b/test/Test/AWS/Gen/CertificateManager.hs
@@ -31,9 +31,15 @@
 --         [ testResendValidationEmail $
 --             resendValidationEmail
 --
+--         , testListTagsForCertificate $
+--             listTagsForCertificate
+--
 --         , testGetCertificate $
 --             getCertificate
 --
+--         , testAddTagsToCertificate $
+--             addTagsToCertificate
+--
 --         , testRequestCertificate $
 --             requestCertificate
 --
@@ -43,6 +49,9 @@
 --         , testDeleteCertificate $
 --             deleteCertificate
 --
+--         , testRemoveTagsFromCertificate $
+--             removeTagsFromCertificate
+--
 --         , testDescribeCertificate $
 --             describeCertificate
 --
@@ -52,9 +61,15 @@
 --         [ testResendValidationEmailResponse $
 --             resendValidationEmailResponse
 --
+--         , testListTagsForCertificateResponse $
+--             listTagsForCertificateResponse
+--
 --         , testGetCertificateResponse $
 --             getCertificateResponse
 --
+--         , testAddTagsToCertificateResponse $
+--             addTagsToCertificateResponse
+--
 --         , testRequestCertificateResponse $
 --             requestCertificateResponse
 --
@@ -64,6 +79,9 @@
 --         , testDeleteCertificateResponse $
 --             deleteCertificateResponse
 --
+--         , testRemoveTagsFromCertificateResponse $
+--             removeTagsFromCertificateResponse
+--
 --         , testDescribeCertificateResponse $
 --             describeCertificateResponse
 --
@@ -77,11 +95,21 @@
     "ResendValidationEmail"
     "fixture/ResendValidationEmail.yaml"
 
+testListTagsForCertificate :: ListTagsForCertificate -> TestTree
+testListTagsForCertificate = req
+    "ListTagsForCertificate"
+    "fixture/ListTagsForCertificate.yaml"
+
 testGetCertificate :: GetCertificate -> TestTree
 testGetCertificate = req
     "GetCertificate"
     "fixture/GetCertificate.yaml"
 
+testAddTagsToCertificate :: AddTagsToCertificate -> TestTree
+testAddTagsToCertificate = req
+    "AddTagsToCertificate"
+    "fixture/AddTagsToCertificate.yaml"
+
 testRequestCertificate :: RequestCertificate -> TestTree
 testRequestCertificate = req
     "RequestCertificate"
@@ -97,6 +125,11 @@
     "DeleteCertificate"
     "fixture/DeleteCertificate.yaml"
 
+testRemoveTagsFromCertificate :: RemoveTagsFromCertificate -> TestTree
+testRemoveTagsFromCertificate = req
+    "RemoveTagsFromCertificate"
+    "fixture/RemoveTagsFromCertificate.yaml"
+
 testDescribeCertificate :: DescribeCertificate -> TestTree
 testDescribeCertificate = req
     "DescribeCertificate"
@@ -111,6 +144,13 @@
     certificateManager
     (Proxy :: Proxy ResendValidationEmail)
 
+testListTagsForCertificateResponse :: ListTagsForCertificateResponse -> TestTree
+testListTagsForCertificateResponse = res
+    "ListTagsForCertificateResponse"
+    "fixture/ListTagsForCertificateResponse.proto"
+    certificateManager
+    (Proxy :: Proxy ListTagsForCertificate)
+
 testGetCertificateResponse :: GetCertificateResponse -> TestTree
 testGetCertificateResponse = res
     "GetCertificateResponse"
@@ -118,6 +158,13 @@
     certificateManager
     (Proxy :: Proxy GetCertificate)
 
+testAddTagsToCertificateResponse :: AddTagsToCertificateResponse -> TestTree
+testAddTagsToCertificateResponse = res
+    "AddTagsToCertificateResponse"
+    "fixture/AddTagsToCertificateResponse.proto"
+    certificateManager
+    (Proxy :: Proxy AddTagsToCertificate)
+
 testRequestCertificateResponse :: RequestCertificateResponse -> TestTree
 testRequestCertificateResponse = res
     "RequestCertificateResponse"
@@ -138,6 +185,13 @@
     "fixture/DeleteCertificateResponse.proto"
     certificateManager
     (Proxy :: Proxy DeleteCertificate)
+
+testRemoveTagsFromCertificateResponse :: RemoveTagsFromCertificateResponse -> TestTree
+testRemoveTagsFromCertificateResponse = res
+    "RemoveTagsFromCertificateResponse"
+    "fixture/RemoveTagsFromCertificateResponse.proto"
+    certificateManager
+    (Proxy :: Proxy RemoveTagsFromCertificate)
 
 testDescribeCertificateResponse :: DescribeCertificateResponse -> TestTree
 testDescribeCertificateResponse = res
