AWS Certificate Manager (ACM) is set to discontinue support for email-validated public certificates throughout 2027, in anticipation of a broader industry shift mandated by the Certification Authority/Browser (CA/B) Forum. The CA/B Forum, which establishes standards for publicly trusted certificates followed by browsers and certificate authorities, has set a deadline of March 15, 2028, after which public certificate authorities will no longer be permitted to use email-based domain validation for issuing or renewing publicly trusted certificates. Certificates issued prior to this date will remain valid until their natural expiration.
AWS will commence its phase-out of email validation on January 1, 2027, when ACM will cease offering this method in new AWS Regions. By March 31, 2027, email validation will no longer be available for any new certificate requests across all AWS Regions. The final step in the phase-out will occur on September 30, 2027, when ACM will stop renewing existing email-validated certificates. AWS strongly advises customers to migrate any affected certificates to DNS validation before this September 30, 2027, deadline.
To identify public certificates that utilize email validation, ACM customers can use either the AWS Management Console or the AWS Command Line Interface (AWS CLI). Within the ACM console, users can apply filters for "Validation method" set to "Email" and "Type" set to "Amazon Issued." Any certificates returned by these filters should be migrated. Similarly, the AWS CLI offers commands to list Amazon-issued certificates in a specified AWS Region and display their validation methods; certificates marked with "EMAIL" as their validation method require migration.
ACM is updating its UpdateCertificateOptions API to facilitate this migration, allowing users to switch a certificate's validation method from email to DNS in place. This means the Amazon Resource Name (ARN) of the certificate will remain unchanged, eliminating the need to modify AWS resources that reference it. Once a customer initiates the switch to DNS validation, ACM provides a CNAME record that must be added to the domain’s DNS configuration within 72 hours. During this 72-hour window, the certificate continues to operate normally using its existing email validation. If the DNS record is not added within the specified timeframe, the certificate remains active with email validation, and the migration process can be retried.
Upon successful completion of DNS validation, ACM is designed to automatically renew the certificate before it expires, provided the required DNS validation record remains in place. Organizations can perform the migration by selecting "Update validation method" in the ACM console and then adding the CNAME records provided by ACM. These records can also be downloaded as a CSV file for use with other DNS providers. For users of Amazon Route 53, the ACM console offers a "Create records in Route 53" option to directly create the necessary validation records.
After email validation is fully discontinued, ACM will continue to support DNS validation for general certificate requests. Additionally, HTTP validation will be available specifically for certificates used with Amazon CloudFront. AWS recommends DNS validation for most use cases. For HTTP validation, ACM provides a unique token that customers must host at a well-known URL path on their domain. This method, like DNS validation, eliminates the manual approval step inherent in email validation and enables automatic certificate renewal by ACM.
