ACM-Certificate-Validation | Vulnerability Database


Plugin Title	ACM Certificate Validation
Cloud	AWS
Category	ACM
Description	ACM certificates should be configured to use DNS validation.
More Info	With DNS validation, ACM will automatically renew certificates before they expire, as long as the DNS CNAME record is in place.
AWS Link	https://aws.amazon.com/blogs/security/easier-certificate-validation-using-dns-with-aws-certificate-manager/
Recommended Action	Configure ACM managed certificates to use DNS validation.

Detailed Remediation Steps

Log into the AWS console and navigate to the ACM service page.
Click into each certificate that has been requested.
Expand the domains associated with the certificate.
Ensure each domain listed has DNS validation configured. If DNS validation is used, DNS records will be listed for the domain.
Ensure that the records provided by AWS are configured and valid within your DNS provider (such as Route 53).
If DNS validation is not used, request a new certificate for the same domains using DNS validation and update the downstream services to use this new certificate. Once done, delete the old certificate to ensure it can no longer be used.