A TLS certificate can be working normally while its next renewal still depends on a person approving an email. That dependency is easy to miss during routine operations and may only surface when renewal notices arrive in an administrative mailbox.

AWS Certificate Manager (ACM) is retiring that workflow in stages. After September 30, 2027, it will no longer renew existing email-validated certificates. The practical question is how to migrate without replacing the certificate on a load balancer, CloudFront distribution, or another AWS resource.

The answer is a new in-place path that preserves the certificate ARN while switching its validation method to DNS. The sections below connect the deadlines to the 72-hour validation window and the CNAME records that must remain after migration.

ACM separates the end of new email validation from the end of renewals

This change has several milestones rather than one shutdown date. The date when new requests lose the option and the date when existing certificates stop renewing have different operational consequences.

• January 1, 2027: ACM will no longer offer email validation in newly opened AWS Regions.
• March 31, 2027: New certificate requests in every Region will no longer offer email validation.
• September 30, 2027: ACM will stop renewing existing email-validated certificates in every Region.
• March 15, 2028: Under the CA/B Forum rules, public certificate authorities can no longer use email-based domain validation to issue or renew publicly trusted TLS certificates. Certificates issued before that date remain valid until they expire.

The AWS operational deadline is September 30, 2027. It does not say that every certificate remains usable until that date; it means an email-validated certificate cannot rely on ACM renewal after it.

At the industry level, CA/B Forum Ballot SC-090 retires methods that send challenges to constructed administrative addresses or contacts published in DNS on March 15, 2028. Its rationale is that email validation adds MX lookups, mail providers, and mailbox access to the validation chain, creating a broader attack surface than direct DNS or HTTP challenges.

The path from retiring WHOIS contacts to retiring email validation

ACM is not removing every part of email validation in one step. In 2024, AWS stopped sending validation messages to contacts discovered through WHOIS: first for new issuance in June and then for renewals in October. The five constructed administrative addresses, such as admin@ and administrator@, remained available. The 2024 AWS Security Blog announcement shows the progression from narrowing the source of email contacts to retiring the remaining email workflow in line with the industry standard.

With email validation, a person follows a link sent to one of the administrative addresses for each domain. The ACM email validation documentation also describes the manual renewal flow, with notices beginning 45 days before expiration.

DNS validation instead places an ACM-provided name and value in public DNS as a CNAME record. According to the ACM DNS validation documentation, ACM can renew an in-use certificate automatically while the correct CNAME remains in place. Migration therefore replaces a repeated human approval step with continuing proof represented by DNS.

In-place migration preserves the ARN and uses a 72-hour DNS window

There is no longer a need to request a separate DNS-validated certificate and replace it on every AWS resource. The updated email-to-DNS migration overview preserves the existing ARN and changes only the validation method. Resources such as Application Load Balancers and CloudFront distributions can continue referring to the same ARN.

An eligible certificate must be a public certificate issued by ACM, currently use email validation, have the Issued status, and have no other migration request in progress. Private certificates from AWS Private CA, imported certificates, and certificates in a status other than Issued are not eligible for this in-place process.

When migration starts, ACM generates one CNAME record for every domain on the certificate. You have 72 hours to publish all of them. Email validation remains active while the request is pending; if ACM cannot verify every record in time, only the migration request expires and the certificate remains email-validated. You can correct the DNS setup and start a new 72-hour window.

After migration, the CNAME is the basis for automatic renewal just as it is for any other DNS-validated ACM certificate. It is persistent lifecycle data, not a temporary record to remove after the first validation.

Inventory each Region before creating and verifying the CNAME records

Start in the ACM console with Validation method = Email and Type = Amazon Issued, and repeat the inventory in every Region you use. Record each certificate ARN, its domain names, attached production resources, DNS zone, and the team that can change that zone. This turns a certificate list into migration batches with clear ownership.

For CLI-based migration, the official console and AWS CLI procedure sets ValidationMethod to DNS through UpdateCertificateOptions. The following minimal example starts migration in the Tokyo Region and then retrieves the CNAME challenges and progress.

aws acm update-certificate-options --region "ap-northeast-1" --certificate-arn "arn:aws:acm:ap-northeast-1:111122223333:certificate/example" --options "ValidationMethod=DNS"

aws acm list-certificate-domain-validations --region "ap-northeast-1" --certificate-arn "arn:aws:acm:ap-northeast-1:111122223333:certificate/example"

Publish the CNAME under RequestedValidationConfiguration for every domain. When Route 53 hosts the zone and the operator has write permission, the console can create the records. Other DNS providers differ in whether they automatically append the zone name, so compare the full ACM-provided name with the record that public DNS actually returns.

Migration is complete when ActiveValidationConfiguration reports ValidationMethod as DNS for every domain. The UpdateCertificateOptions API reference confirms that the operation updates the validation method for the supplied ARN, so resources referring to the certificate do not need a new reference. Bring the CNAMEs into DNS configuration management or change procedures so later cleanup does not remove them.

Move certificate ownership into DNS before the 2027 renewal cutoff

The answer to the opening question is to use ACM's in-place migration rather than reissuing and reattaching the certificate. The ARN stays the same while validation moves from an email approval to a DNS record.

Preserving references does not eliminate the DNS work. The operator still needs permission to change public DNS and must validate every domain on the certificate. Inventorying the Regions first and testing the 72-hour workflow on a small batch provides room to correct ownership or DNS-provider issues before production renewals depend on it.

After March 31, 2027, new requests cannot fall back to email validation, and after September 30, existing email-validated certificates cannot rely on ACM renewal. Moving while certificates are still healthy turns the announcement into a controlled lifecycle change instead of an expiration incident.

Source

• Title: AWS Certificate Manager will discontinue email validation to prove domain validation for certificates
• URL: https://aws.amazon.com/blogs/security/aws-certificate-manager-will-discontinue-email-validation-to-prove-domain-validation-for-certificates/