AWS Certificate Manager (ACM) issues free public certificates for AWS services such as load balancers, CloudFront and API Gateway, and renews them automatically. "Automatically" comes with conditions, though. When one isn't met, ACM can't renew, and the certificate expires on the date it always had.
When ACM renews on its own
ACM starts managed renewal 60 days before expiry. It succeeds without any action from you when all of these hold:
- The certificate was issued by ACM. Imported certificates are never renewed by ACM.
- It's in use: associated with an AWS resource such as a load balancer listener, a CloudFront distribution or an API Gateway domain.
- ACM can validate each domain again:
- DNS validation: the
_xxxx.example.comCNAME record ACM gave you is still in your DNS. - Email validation: someone clicks the approval link in a renewal email, for every renewal.
- DNS validation: the
- Your domain's CAA records, if you have any, allow Amazon to issue.
The usual reasons renewal fails
| Cause | What happened | Fix |
|---|---|---|
| Validation CNAME deleted | Someone cleaned up DNS, moved DNS providers, or the record was never added after a migration | Add the CNAME back. Find it in ACM under the certificate's Domains section. ACM retries automatically. |
| Email validation | Renewal emails went to an unread mailbox (admin@, hostmaster@ or the WHOIS contact) | Approve the email, then switch to DNS validation by requesting a new DNS-validated certificate and moving resources to it |
| Certificate not in use | The load balancer or distribution was deleted, or moved to another certificate | Ignore it if it's no longer needed; otherwise associate it again |
| Imported certificate | You uploaded a certificate from another CA | Renew it with that CA and re-import it (same ARN, so resources pick it up), or replace it with an ACM-issued one |
| CAA records block Amazon | A CAA record lists only another CA | Add 0 issue "amazon.com" (and amazontrust.com, awstrust.com, amazonaws.com as AWS documents) |
Check a certificate's renewal status
In the console, open ACM, then the certificate: Renewal status and the per-domain Validation status show what's blocking. From the CLI:
aws acm describe-certificate --region us-east-1 \
--certificate-arn arn:aws:acm:us-east-1:123456789012:certificate/abcd-1234 \
--query 'Certificate.{status:Status,expires:NotAfter,renewal:RenewalSummary,inUse:InUseBy}'
RenewalSummary.RenewalStatus of PENDING_VALIDATION or FAILED, with a RenewalStatusReason, tells you which domain needs attention.
List every certificate in a region with its expiry date:
aws acm list-certificates --region us-east-1 \
--query 'CertificateSummaryList[].[DomainName,NotAfter,RenewalEligibility]' --output table
ACM certificates are regional. Check every region you use, and remember that CloudFront uses certificates from us-east-1 only.
Get warned in time
- ACM sends an "ACM Certificate Approaching Expiration" event to Amazon EventBridge daily from 45 days before expiry; route it to email or chat with an EventBridge rule and an SNS topic.
- AWS Health also notifies the account's contacts about upcoming expiries.
Both depend on someone watching that account's notifications. An outside check of what your site actually serves catches every case, including certificates outside AWS and CDNs in front of AWS.
Check what visitors see
Run the SSL checker on the domain: it shows the certificate the load balancer or CloudFront really serves and its expiry date.
CertHalo monitors any public site, AWS or not, and emails you 60, 30, 14, 7, 3 and 1 day before a certificate expires. Monitor 3 certificates free.
Related: Preparing for 47-day certificates · Find all your SSL certificates