AWS Certificate Manager (ACM) is ending email validation for public certificates. The AWS Security Blog announcement of August 13, 2026 sets two dates: ACM stops taking new email-validated requests on March 31, 2027, and stops renewing email-validated certificates on September 30, 2027. The fix is to move each certificate to DNS validation before then. Here's what we check so a renewal you've ignored for years doesn't become an outage.
Email validation proves you own a domain by sending an approval link to an address at that domain and waiting for someone to click it. DNS validation proves the same thing with a CNAME record in your DNS zone.
1. Find the email-validated certificates you forgot about. In the ACM console, filter on Validation method = Email and Type = Amazon Issued. Repeat it in every region, not only the one you use most. Older AWS accounts collect certificates in regions nobody checks, and those are the ones that lapse quietly.
2. Prove you control every DNS zone. DNS validation assumes you can add a CNAME record. On older systems, that's where it breaks. The domain sits at a registrar under a login that left with a former employee, or a third party runs the zone and answers slowly. Write a test record to each zone before renewal day, not on it.
3. Switch the certificates you control now. AWS lets you change a certificate from email to DNS validation in place. The ARN stays the same, so nothing that references the certificate has to change. You get a CNAME record and 72 hours to add it, and the certificate keeps working on email validation during that window. There's no reason to wait for 2027.
4. Add an expiry alert that doesn't trust the automation. Email validation failed the way old infrastructure usually fails: silently, into an inbox nobody reads. With DNS validation, ACM renews automatically as long as the record stays in place. Set an independent expiry alert anyway. Assume the automation breaks on the one certificate that matters, and send that alert somewhere a person will see it.
5. Check your certificates from other CAs, too. The deadline comes from the CA/Browser Forum, the industry body that sets the rules for public certificates. After March 15, 2028, no public certificate authority, AWS or any other, can use email validation to issue or renew a trusted certificate. Certificates issued before then stay valid until they expire. AWS just gives you the earliest date.
None of these steps is hard. The risk isn't difficulty, it's discovery: the certificate that takes a site down is the one in a region you forgot, on a domain you're not sure you control. Find those while the switch is a five-minute change. Certificates fail the same quiet way that account access does, which is why keeping admin access to your AWS account belongs on the same list.
If you want this inventory run across your AWS accounts before a renewal becomes an incident, that's routine work for our AWS practice.