AWS Certificate Manager to Retire Email Validation for Public Certificates by 2027, Mandating DNS Validation Migration
What Happened — AWS Certificate Manager (ACM) will discontinue email‑based domain validation for public certificates. The phase‑out begins Jan 1 2027 (new regions), ends Mar 31 2027 (all regions), and ACM will stop renewing existing email‑validated certificates on Sep 30 2027. Customers must migrate to DNS validation before that date.
Why It Matters for Compliance & Audit Readiness
- The shift creates a control‑gap risk if organizations continue to rely on a deprecated validation method, potentially leading to expired certificates and service disruption.
- SOC 2 Change Management and Asset Management controls require documented, repeatable processes for certificate lifecycle changes; DNS migration must be captured as evidence.
- Continuous‑compliance programs benefit from automated detection of email‑validated certificates and proof of remediation, aligning with the Control Mapping capability.
Who Is Affected — Cloud‑infrastructure providers, SaaS platforms, and any organization that uses AWS public certificates for web services.
Recommended Actions
- Run the ACM console filter or AWS CLI command to inventory all email‑validated certificates.
- Use the new
UpdateCertificateOptionsAPI to switch each certificate to DNS validation, preserving the ARN. - Add the supplied CNAME record to your DNS zone within 72 hours and verify successful validation.
- Document the migration in your change‑management system and retain the DNS record as continuous audit evidence.
Source: Help Net Security
Technical Notes
- No vulnerability or exploit is involved; the change follows the CA/B Forum’s March 15 2028 deadline to end email‑based domain validation.
- Migration relies on DNS‑based CNAME validation; failure to add the record within 72 hours leaves the certificate on email validation, requiring a retry.
Source: same as above