ACM Certificate Validation
ACM certificates should be configured to use DNS validation.
With DNS validation, ACM will automatically renew certificates before they expire, as long as the DNS CNAME record is in place.
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
-
Log in to the AWS console and search for “Certificate Manager”.
-
Click into each certificate that has been requested.
-
Expand the domains associated with the certificate.
-
Ensure each domain listed has DNS validation configured. If DNS validation is used, DNS records will be listed for the domain and the type will be CNAME.
-
Ensure that the records provided by AWS are configured and valid within your DNS provider (such as Route 53).
-
If DNS validation is not used, request a new certificate for the same domains using DNS validation and update the downstream services to use this new certificate. Once done, delete the old certificate to ensure it can no longer be used.
