AWS is discontinuing email validation for ACM public certificates by September 30, 2027, to line up with the CA/B Forum's industry-wide deprecation. If you run a legacy estate, a renewal you have ignored for years is about to need attention. Here is what we check before it turns into an outage.
1. Find the email-validated certs you forgot you had. In the ACM console, filter on Validation method = Email and Type = Amazon Issued. Do it in every region, not just the one you live in. Old estates accumulate certs in regions nobody looks at, and those are exactly the ones that lapse quietly.
2. Confirm you actually control the DNS zones. This is where legacy estates break. DNS validation needs you to add a CNAME, which assumes you can. On an old system the domain is often at a registrar someone left the company with, or the zone is run by a third party who does not answer quickly. Prove you can write records to every zone before renewal day, not on it.
3. Pre-stage the DNS records now. AWS lets you switch a cert from email to DNS in place: same ARN, no reissue, no change to the resources that reference it. You get a CNAME and 72 hours to add it, and the cert keeps working on email validation the whole time. There is no reason to wait for the deadline. Switch the ones you control this quarter and take them off the list.
4. Wire up expiry monitoring. Email validation failed the way old infrastructure always fails: silently, to an inbox nobody reads. Once you move to DNS, ACM renews automatically as long as the record stays in place, but you still want an independent expiry alert. Assume the automation will break on the one cert that matters, and monitor for it.
5. Don't file this under AWS-only. The deadline comes from the CA/B Forum, and email-validated certificates stop being trusted by browsers on March 15, 2028, whoever issued them. If your estate has certs from other CAs on email validation, they are on the same clock. AWS just handed you the earliest date.
None of these steps is hard. The risk is not difficulty, it is discovery: the certificate that takes a site down is the one in a region you forgot, on a domain you are not sure you control. Find those now, while the switch is a five-minute change and not an incident.
Cert and DNS migrations inside legacy cloud estates are routine work for us, and this is the kind of inventory we run before a renewal becomes a fire.