AWS Certificate Manager to Deprecate Email Validation by 2027
AWS Certificate Manager (ACM) will phase out email validation for public certificates throughout 2027, aligning with upcoming industry standards that prohibit this method for publicly trusted certificates.
Amazon Web Services (AWS) announced that its Certificate Manager (ACM) service will discontinue support for email validation for public certificates by the end of 2027. This move is in preparation for the Certification Authority/Browser (CA/B) Forum's mandate, which will prohibit the use of email-based domain validation for issuing or renewing publicly trusted certificates starting March 15, 2028. While certificates issued before this deadline will remain valid until their expiration, organizations relying on email validation for their ACM certificates will need to migrate to alternative methods.
The phase-out process will begin on January 1, 2027, when ACM will stop offering email validation in new AWS Regions. By March 31, 2027, this validation method will be unavailable for all new certificate requests across all AWS Regions. Furthermore, ACM will cease renewing existing email-validated certificates on September 30, 2027, making it imperative for customers to switch to a different validation method before this date.
AWS is strongly recommending that affected customers migrate their certificates to DNS validation. To facilitate this transition, ACM is updating its UpdateCertificateOptions API. This enhancement will allow customers to switch a certificate's validation method from email to DNS without altering the certificate's Amazon Resource Name (ARN), thereby avoiding the need to update any AWS resources that reference the certificate.
Once a customer initiates the switch to DNS validation, ACM will provide a CNAME record. This record must be added to the domain's DNS configuration within 72 hours. During this migration window, the certificate will continue to operate normally using the existing email validation. If the CNAME record is not successfully added within the 72-hour period, the certificate will remain active with email validation, and the migration process can be retried.
Upon successful completion of DNS validation, ACM is designed to automatically renew the certificate before its expiration, provided the necessary DNS validation record remains in place. This automated renewal process aims to minimize manual intervention and ensure continuous certificate validity. Customers can identify email-validated certificates through the AWS Management Console by filtering for 'Email' validation method and 'Amazon Issued' type, or via the AWS Command Line Interface (AWS CLI).
For certificates used with Amazon CloudFront, ACM will also support HTTP validation after email validation is discontinued. This method involves hosting a unique token provided by ACM at a specific URL path on the domain. Similar to DNS validation, HTTP validation eliminates the manual approval step inherent in email validation and enables automatic certificate renewals.
This strategic shift by AWS reflects a broader industry trend towards more robust and automated domain validation methods. The move away from email validation is driven by security concerns, as email-based validation can be susceptible to phishing and other social engineering attacks. By enforcing DNS or HTTP validation, the CA/B Forum and services like ACM aim to enhance the overall security and trustworthiness of the public key infrastructure (PKI).