AWS Certificate Manager sets 2027 end date for email-validated certificate renewals
AWS Certificate Manager (ACM) will phase out email validation for public certificates throughout 2027, ahead of the Certification Authority/Browser (CA/B) Forum’s March 15, 2028 deadline for ending email-based domain validation.
The CA/B Forum sets standards that browsers and certificate authorities follow for publicly trusted certificates. From March 15, 2028, public certificate authorities will no longer be able to use email-based domain validation to issue or renew publicly trusted certificates. Certificates issued before that date will remain valid until they expire.
AWS email validation phaseout
AWS will begin phasing out email validation on January 1, 2027, when ACM will stop offering the method in new AWS Regions.
From March 31, 2027, email validation will no longer be available for new certificate requests in any AWS Region. ACM will stop renewing existing email-validated certificates on September 30, 2027. AWS recommends migrating affected certificates to DNS validation before that date.
Moving certificates to DNS validation
ACM customers can check whether their public certificates use email validation through the AWS Management Console for ACM or the AWS Command Line Interface (AWS CLI).
In the ACM console, users can identify email-validated certificates by setting the Validation method filter to Email and the Type filter to Amazon Issued. Certificates returned by those filters should be migrated before September 30, 2027.
Users can also identify affected certificates through the AWS CLI. AWS provides commands that list Amazon-issued certificates in a selected AWS Region and display their validation methods. Certificates whose validation method is marked EMAIL use email validation and should be migrated.
“To assist you in this migration, ACM is updating the UpdateCertificateOptions API so you can switch a certificate’s validation method from email to DNS in place. This means the certificate Amazon Resource Name (ARN) will remain the same and no changes will be needed to your AWS resources that reference the certificate,” Adam Aboudi, Senior Technical Product Manager on the AWS Certificate Manager team, and Poojil Tripathi, Solutions Architect at AWS, explained.
After a customer initiates the switch to DNS validation, ACM provides a CNAME record that must be added to the domain’s DNS configuration within 72 hours. During that window, the certificate continues to operate normally using email validation. If the DNS record is not added within 72 hours, the certificate remains active with email validation and the migration can be retried.
Once DNS validation is completed, ACM is designed to renew the certificate automatically before it expires without further manual intervention, provided the required DNS validation record remains in place.
Organizations can migrate an email-validated certificate by selecting Update validation method in the ACM console and then adding the CNAME records provided by ACM. The records can also be downloaded as a CSV file for use with other DNS providers. Amazon Route 53 users can create the required validation records directly from the ACM console using the Create records in Route 53 option.
HTTP validation for CloudFront certificates
After email validation is discontinued, ACM will support DNS validation for general certificate requests and HTTP validation for certificates used with Amazon CloudFront. AWS recommends DNS validation for most use cases.
For HTTP validation, ACM provides a unique token that customers host at a well-known URL path on their domain. The method is available only for certificates used with Amazon CloudFront. Like DNS validation, it removes the manual approval step required by email validation and allows ACM to renew certificates automatically.