ACM deprecates email validation for public certificates by September 2027
AWS Certificate Manager (ACM) announces the discontinuation of email-validated public certificates by September 30, 2027, in alignment with industry standards from the CA/B Forum. Customers currently using email validation must migrate their certificates to DNS validation to ensure continued browser trust and automatic renewal. ACM provides an updated API to facilitate in-place migration, offering a full year ahead of the CA/B Forum's hard deadline of March 2028. This change affects all users with email-validated ACM public certificates.
- →Email validation method for ACM certificates to be deprecated
- →Key timelines for email validation deprecation
- →Instructions to identify email-validated certificates
- →In-place migration to DNS validation via updated API
- →Remaining validation methods supported by ACM
Deprecations (1) ›
- Email validation method for ACM certificates to be deprecated
AWS Certificate Manager will discontinue support for email-validated public certificates by September 30, 2027, aligning with the CA/B Forum’s industry-wide deprecation. Customers must migrate to DNS validation before this date to ensure certificates remain trusted.
Enhancements (1) ›
- In-place migration to DNS validation via updated API
ACM has updated the UpdateCertificateOptions API to allow in-place switching from email to DNS validation, preserving the certificate ARN. The process involves adding a CNAME record to DNS configuration, with ACM handling automatic renewals thereafter.
Notes (3) ›
- Key timelines for email validation deprecation
ACM will no longer offer email validation in new AWS Regions by January 1, 2027, for new certificate requests by March 31, 2027, and will cease renewing existing email-validated certificates by September 30, 2027.
- Instructions to identify email-validated certificates
Customers can use the AWS Management Console or the AWS CLI to filter and identify public ACM certificates that are currently using email validation, making it easier to plan their migration.
- Remaining validation methods supported by ACM
After email validation is deprecated, ACM will continue to support DNS validation for most use cases and HTTP validation specifically for certificates used with Amazon CloudFront, both offering automatic renewal.
https://aws.amazon.com/blogs/security/aws-certificate-manager-will-discontinue-email-validation-to-prove-domain-validation-for-certificates/
Related releases
- AWS explains how Amazon Connect flow modules enable nested architectures and cross-flow reuse AWS Contact Center Blog ·
- AWS Certificate Manager now supports switching existing certs from email to DNS validation AWS What's New ·
- Amazon Q introduces approval policies for enhanced asset sharing governance AWS What's New ·
- AWS Client VPN now supports CLI, administration controls, and faster connections AWS What's New ·
- Amazon Quick now supports per-user resource limits AWS What's New ·
- Claude Opus 5 Now Available in AWS GovCloud (US) AWS What's New ·