AWS Certificate Manager (ACM) will drop support for email-validated public certificates by September 30, 2027. Anyone using email validation to prove domain ownership for ACM certificates needs to migrate to DNS validation before that date.
TL;DR
- -ACM will stop renewing email-validated certificates by September 30, 2027, roughly six months before the CA/Browser Forum's industry-wide deadline of March 15, 2028.
- -AWS is updating the UpdateCertificateOptions API so customers can switch a certificate from email to DNS validation in place, keeping the same ARN and a 72-hour window to add the required CNAME record.
- -Affected certificates can be found in the ACM console by filtering for Validation method = Email and Type = Amazon Issued, or by running a CLI script with aws acm list-certificates and aws acm describe-certificate.
What Is Changing and Why
When you request a public SSL/TLS certificate, a certificate authority must verify that you control the domain. ACM has historically offered two ways to do that: DNS validation, where you add a CNAME record to your domain's DNS configuration, and email validation, where ACM sends a confirmation link to standard administrative addresses for the domain.
The change is driven by an industry standard body. The CA/Browser Forum voted in November 2025 to end email-based domain validation across all certificate authorities, effective March 15, 2028. Browsers will stop trusting certificates validated by email after that date, regardless of which CA issued them. ACM is aligning its own deadline to September 30, 2027, giving customers roughly six months ahead of the CA/B Forum's hard cutoff.
The Four Key Dates
AWS has set a phased timeline for the deprecation:
- January 1, 2027: ACM stops offering email validation in new AWS Regions.
- March 31, 2027: ACM stops accepting email validation for new certificate requests in all Regions.
- September 30, 2027: ACM stops renewing existing certificates that still use email validation.
- March 15, 2028: The CA/B Forum deadline. Certificate authorities industry-wide can no longer issue or renew publicly trusted certificates using email-based domain validation.
How the Migration Works
AWS is updating the UpdateCertificateOptions API to let customers switch a certificate's validation method from email to DNS in place. The certificate's Amazon Resource Name (ARN) stays the same, so AWS resources already referencing the certificate do not need reconfiguration.
Once you trigger the switch, ACM provides a CNAME record. You have 72 hours to add that record to your DNS configuration. During that window, the certificate continues to operate on email validation. If the window closes without the DNS record in place, the certificate stays active on email validation and the migration can be retried later.
After DNS validation is confirmed, ACM is designed to renew the certificate automatically before it expires, without further action required.
For Route 53 users, ACM offers a one-click option in the console to create the required DNS records directly. Users on other DNS providers can export the CNAME records as a CSV file.
Finding Affected Certificates
AWS offers two ways to identify email-validated certificates. In the ACM console, filtering by Validation method = Email and Type = Amazon Issued returns the full list. Via the AWS Command Line Interface, a shell script using aws acm list-certificates and aws acm describe-certificate can scan a Region and output every certificate still using email validation.
What Happens After Email Validation Ends
ACM will support two validation methods going forward. DNS validation remains the primary option and enables fully automatic renewal. HTTP validation is available only for certificates used with Amazon CloudFront, where ACM provides a token that must be hosted at a specific URL path on the domain. Both methods eliminate the manual approval step that email validation requires.
Sources and supporting resources