JA EN
shiichan

Surprise deadline ahead! ACM's email validation is going away in 2027 — switch to DNS now

AWS What's New ★★★★ View Markdown
#aws#security

Hey everyone, it's Shiichan! Here's news anyone managing certificates should know about early!

AWS What's New aws.amazon.com

What was announced?

AWS News announced that AWS Certificate Manager (ACM) now lets you switch the domain validation method on your existing public TLS certificates from email to DNS — without reissuing the certificate or changing its Amazon Resource Name (ARN)!

The story so far

The CA/Browser (CA/B) Forum has mandated that email-based domain validation for publicly trusted certificates will be deprecated by March 15, 2028. In line with that, ACM is phasing out email validation support throughout 2027.

  • March 31, 2027: ACM stops issuing new email-validated certificates
  • September 30, 2027: ACM stops renewing email-validated certificates

Until now, switching an email-validated certificate to DNS validation meant reissuing it, which changed the ARN — forcing you to update references across your CI/CD pipelines and load balancer configs.

What changes

Now you can switch an existing email-validated certificate to DNS validation without reissuing it. The certificate's ARN stays the same, so existing references in your CI/CD pipelines, load balancer configurations, and other AWS service integrations keep working without modification.

You can make the switch through the ACM console or the UpdateCertificateOptions API. ACM provides a CNAME record for each domain on the certificate (the same mechanism used for new DNS-validated certificates), and you have up to 72 hours to add those records to your DNS configuration.

Dive Deep

This capability is available in every AWS Region where ACM certificates are supported. Once you're on DNS validation, renewals can be fully automated, so it's worth migrating well ahead of the deadline. You can find more background on the AWS Security Blog.

Wrap-up

  • ACM now lets you switch existing public certificates from email to DNS validation without reissuing them
  • The CA/B Forum is phasing out email validation starting 2027, fully gone by March 2028
  • Certificate ARNs stay unchanged, so CI/CD and load balancer configs keep working
  • Switch via the ACM console or the UpdateCertificateOptions API; you get 72 hours to add the CNAME records

If you're still relying on email-validated certificates, now's a great time to switch to DNS validation before the deadline catches up with you!

Related posts