This update includes important information about end of support, deprecation, or migration. Please check the original announcement for details.
AWS Certificate Manager supports switching from email to DNS validation
AWS Certificate Manager now allows changing the domain validation method on existing public TLS certificates from email to DNS without reissuing the certificate or changing its ARN, enabling automated renewals ahead of the 2028 deadline.
AWS Certificate Manager (ACM) now enables changing the domain validation method on existing public TLS certificates from email to DNS without reissuing the certificate or altering its Amazon Resource Name (ARN). Due to the CA/B Forum's mandate to deprecate email-based validation for publicly trusted certificates by March 15, 2028, ACM will phase out email validation support throughout 2027. Switching to DNS validation now allows customers to transition before the deadline and enables fully automated renewals. The certificate ARN remains unchanged, so existing references in CI/CD pipelines, load balancer configurations, and other AWS service integrations continue to work. To switch, use the ACM console or the UpdateCertificateOptions API, adding the provided CNAME records to DNS within 72 hours. DNS validation is recommended for new certificates, while HTTP validation is suggested for Amazon CloudFront distributions. This feature is available in all regions where ACM certificates are offered.
Why it matters
This update affects developers and security professionals managing public TLS certificates. It extends AWS Certificate Manager's certificate management capabilities, facilitating migration away from email validation ahead of its deprecation.