ACM stops renewing email-validated certificates on 30 September 2027, and the migration docs never say so

Summary. AWS Certificate Manager announced on 13 August 2026 that you can switch an existing public certificate from email validation to DNS validation without reissuing it or changing its ARN. The announcement carries three dates the AWS documentation does not: ACM stops issuing email-validated certificates on 31 March 2027, stops renewing them on 30 September 2027, and the CA/Browser Forum's mandated deprecation of email-based domain validation takes effect on 15 March 2028. From 22 August 2026 that is 221, 404 and 571 days. Search the ACM User Guide chapters covering the migration, email validation, DNS validation, renewal and the document history, and the strings "2027" and "2028" do not appear. The migration itself is one-way: "Migration from DNS to email validation is not supported." You have 72 hours to publish the CNAME records once you start, and if you miss it the request expires and the certificate stays email-validated. Public ACM certificates have also been 198 days long since 15 March 2026, down from 395, so the manual email click you used to do roughly once a year now comes round nearly twice.

The three dates, and where they live

From the AWS What's New post of 13 August 2026:

Due to the Certification Authority/Browser (CA/B) Forum's mandated deprecation of email-based domain validation for publicly trusted certificates, effective March 15, 2028, ACM will phase out its support for email validation throughout 2027. ACM will no longer issue email-validated certificates starting March 31 2027, and stop renewing email-validated certificates on September 30 2027.

Now open the documentation. The ACM User Guide chapter "Migrating from email to DNS validation" and its two subpages, "How migration works" and "Migrating a certificate (console or AWS CLI)", describe the mechanism in full and give no reason to do it beyond automated renewals. The "AWS Certificate Manager email validation" page describes email validation as a current, supported option and links the migration page as a convenience. The document history's entry for the feature is dated 9 July 2026, five weeks before the announcement, and reads only: "You can now migrate an existing email-validated public ACM certificate to DNS validation while preserving the certificate ARN."

None of those pages carries an end-of-life date. An engineer who finds this feature through the documentation, which is how most people find AWS features, will read it as an optional convenience. It is not. It is a migration with a hard floor 404 days out.

Why the clock is faster than it looks

Two changes compound. The first is certificate validity. Per the ACM document history entry of 18 February 2026, public ACM certificates are now valid for 198 days, reduced from 13 months (395 days), to comply with CA/B Forum requirements that certificates issued after 15 March 2026 carry a maximum validity of 200 days. The renewal window moved with it, from 60 days before expiration to 45.

The second is what email validation demands at each renewal. The email validation page is explicit: "ACM certificates are valid for 198 days. Renewing a certificate requires action by the domain owner. ACM begins sending renewal notices to the email addresses associated with the domain 45 days before expiration. The notifications contain a link that the domain owner can click for renewal."

So a human clicks a link in an email, for every email-validated certificate, roughly every 198 days instead of every 395. On a fleet of any size that is not a minor increase in toil, and the ACM quota table allows 2,500 certificates per Region per account by default. It is also the reason the deprecation makes sense: manual email approval does not survive certificate lifetimes that keep shrinking.

Work the arithmetic on a certificate that renews today. It expires around 8 March 2027 and enters its renewal window around 22 January 2027, both comfortably before the 31 March 2027 issuance cutoff. Renew again in the second half of 2027 and you are into the 30 September 2027 wall. A certificate that manages a final email renewal on 30 September 2027 expires around 15 April 2028. That is the outside edge for anyone who does nothing: mid-April 2028, and then the certificate is gone.

What the migration actually does

ACM generates one CNAME record for each domain on the certificate. You publish them, ACM verifies them, and the certificate switches validation method. Four properties from the "How migration works" page matter operationally:

The certificate ARN is preserved. AWS says explicitly that "existing ARN references in your CI/CD pipelines, load balancer configurations, and other AWS service integrations continue to work without modification." That removes the usual reason to defer a certificate change.

The expiration date is preserved in most cases. If the certificate happens to sit inside its renewal window when you migrate, ACM renews it during migration and extends the expiry.

After migration the certificate behaves like any other DNS-validated ACM certificate, renewing automatically as long as the validation records stay in place.

And it is one-way. The guide states it as an Important callout: "You can only migrate from email to DNS validation. Migration from DNS to email validation is not supported." Given the 2027 deadlines, there is no scenario where you would want to go back, but it does mean a migration performed on the wrong certificate cannot be undone by reversing it.

The 72-hour window, and the other 72-hour window

Once you initiate, you have up to 72 hours to add the CNAME records. If ACM does not verify them in that time, the migration request expires and the certificate remains email-validated and working. You can reinitiate at any time, which starts a fresh 72-hour window.

There is a second, unrelated 72-hour timer in the same service, and confusing them will cost someone an afternoon. Email validation tokens also expire after 72 hours: "because the validation email required for the approval process can be blocked by spam filters or lost in transit, the token automatically expires after 72 hours." One 72-hour clock governs the DNS records you publish. The other governs a link in an email you may never have received.

Monitoring the migration is a specific API call, not the general certificate describe. ListCertificateDomainValidations returns, per domain, an ActiveValidationConfiguration showing the method currently in effect, which reads EMAIL for the whole time the migration is in flight, and a RequestedValidationConfiguration showing the target method DNS, the CNAME record you must publish, and a status that stays PENDING_VALIDATION until verified. Migration completes only when every domain on the certificate is verified.

            aws acm update-certificate-options \
    --certificate-arn arn:aws:acm:us-east-1:111122223333:certificate/12345678-1234-1234-1234-123456789012 \
    --options ValidationMethod=DNS

aws acm list-certificate-domain-validations \
    --certificate-arn arn:aws:acm:us-east-1:111122223333:certificate/12345678-1234-1234-1234-123456789012
          

The CNAME for each domain sits at RequestedValidationConfiguration.DnsValidationChallenge.ResourceRecord. In the console the action is under Actions on the certificate details page, the guide notes its exact label "might vary", and multiple certificates can be selected and migrated together. If the domain is hosted in Route 53 and you can write to the zone, the console will create the records for you.

What cannot be migrated, and what to do instead

The eligibility list is short and the exclusions are the interesting part. A certificate can migrate when it is a public certificate issued by ACM, currently uses email validation, has status Issued, and has no other migration request in progress.

Two things to be careful about here. A certificate stuck in a non-Issued state cannot be migrated at all, so any certificate sitting in Validation timed out or Failed needs to be requested again from scratch with DNS validation, not repaired. And private certificates from AWS Private CA are outside this entirely: ACM does not validate domain ownership for them, and the February 2026 validity change kept them at 395 days while public certificates dropped to 198.

The renewal condition nobody reads

There is one more requirement in the DNS renewal page that catches teams after migration, and it has nothing to do with validation method. At 45 days before expiration ACM checks two criteria before renewing: that all required CNAME records are present and publicly resolvable, and that "the certificate is currently in use by an AWS service."

An ACM certificate that is not attached to a load balancer, CloudFront distribution, API Gateway or similar does not meet the second condition. Migrating it to DNS validation does not make it renew. If you have certificates issued for a service that has since been decommissioned, or exported for use outside AWS, that gap is already there and the migration will not close it.

ACM does tell you when automatic validation fails. The renewal page lists AWS Health and Amazon EventBridge events sent at 30, 15, seven, three and one day before expiration when a domain cannot be automatically validated. Wire those to a channel someone reads, because the first three notifications land while there is still time to fix a DNS record and the last one does not.

Before you migrate anything

Inventory first. Filter certificates by validation method using certificate search to find every email-validated public certificate in every Region and account, since ACM quotas are per Region per account and certificates are easy to lose track of in a Region nobody looks at.

Check that you still control the validation mailbox for the ones you cannot migrate immediately. ACM sends validation email to five common system addresses only, administrator@, hostmaster@, postmaster@, webmaster@ and admin@ at the domain, and the guide adds an Important note that "ACM no longer supports WHOIS email validation for new certificates or renewals." Teams that relied on the WHOIS contact have already lost their renewal path and may not know it.

Then migrate in batches you can finish inside 72 hours, and treat the CNAME records as permanent infrastructure. They are what makes renewal automatic; delete them later and the certificate stops renewing.

India-specific considerations

Nothing in this timeline is Region-specific, which is the point worth making to Indian teams running in ap-south-1 or ap-south-2: there is no staged rollout to wait for. The 31 March 2027 and 30 September 2027 dates are service-wide. The operational cost is in the DNS side, and teams whose apex domain is managed by a registrar outside AWS, which is common for Indian companies holding .in domains with a local registrar, should confirm they can create CNAME records at that provider before starting the 72-hour clock. Where the domain sits in Route 53, the console can write the records for you and the constraint disappears.

What is still unknown

AWS has not published, in the documentation, what happens to an email-validated certificate that is inside its renewal window on 30 September 2027. The announcement says renewals stop on that date; it does not say whether a renewal already in progress completes. The documentation says nothing at all, because it does not acknowledge the deadline. The announcement also points at an AWS Security Blog post for details of the deprecation, so the authoritative timeline currently lives in a blog and a What's New entry rather than in the user guide, which is the reverse of where an operations team would look for it.

FAQ

How eCorpIT can help

We run DevOps and platform engineering for teams whose certificate inventory has outgrown a spreadsheet, and a cross-account, cross-Region ACM audit against the 31 March 2027 cutoff is a bounded piece of work with a fixed answer at the end of it. If your validation records need to move to a registrar you do not control, that is the part worth starting early. Talk to us through /contact-us/.

Related reading: our analysis of the OpenAI Python 3.0 TLS breakage in minimal containers and Kubernetes 1.35 pod certificates and constrained impersonation.

References

1. AWS Certificate Manager supports switching from e-mail to DNS validation — AWS What's New, 13 August 2026, source of the 31 March 2027, 30 September 2027 and 15 March 2028 dates.

1. How migration works — AWS Certificate Manager User Guide, the 72-hour window, ARN preservation and eligibility list.

1. Migrating a certificate (console or AWS CLI) — AWS Certificate Manager User Guide.

1. Migrating from email to DNS validation — AWS Certificate Manager User Guide chapter index.

1. AWS Certificate Manager email validation — the five system addresses, the 198-day validity and the WHOIS note.

1. Renewal for domains validated by DNS — the two renewal criteria and the EventBridge notification schedule.

1. Document history for AWS Certificate Manager — the 9 July 2026 migration entry and the 18 February 2026 validity change.

1. Troubleshoot email validation problems — the timed-out migration procedure.

1. Quotas — 2,500 ACM certificates per Region per account, 10 domain names per certificate by default.

1. UpdateCertificateOptions — AWS Certificate Manager API Reference.

1. ListCertificateDomainValidations — AWS Certificate Manager API Reference.

1. AWS Certificate Manager DNS validation — AWS Certificate Manager User Guide.

Last updated: 22 August 2026.