AWS Certificate Manager (ACM) has announced plans to permanently discontinue email-based domain control validation (DCV) for public certificate renewals by September 30, 2027.
The deprecation aligns AWS cloud infrastructure with global trust mandates established by the Certificate Authority and Browser (CA/B) Forum, requiring cloud architects, DevOps engineers, and security teams to transition legacy certificates to DNS validation.
The transition follows a landmark vote by the Certificate Authority and Browser (CA/B) Forum in November 2025 to eliminate email-based domain validation for public TLS/SSL certificates. Starting March 15, 2028, major web browsers will distrust any public certificate validated using email verification, regardless of the issuing Certificate Authority (CA).
The cryptographic community has long recognized email validation as brittle and vulnerable. Compromised mail exchange (MX) routing, intercepted verification links, and outdated WHOIS administrative contacts introduce substantial supply-chain risks.
Following established standards for protecting SSL/TLS certificates ensures that organizations maintain strict control over identity validation and avoid unexpected browser distrust errors.
AWS Certificate Manager Ends Email Validation
To protect customer workloads from certificate renewal failures well ahead of the 2028 browser distrust deadline, AWS is implementing an accelerated multi-stage phaseout schedule:
| Milestone Date | Operational Enforcement & Impact |
| January 1, 2027 | Email validation restricted across newly launched AWS Regions. |
| March 31, 2027 | Email validation prohibited for newly requested certificates across all AWS Regions. |
| September 30, 2027 | Complete termination of email-based automated renewals in ACM. |
| March 15, 2028 | Global CA/B Forum deadline: Major browsers distrust all email-validated certificates. |
To ensure a smooth transition without requiring infrastructure changes, AWS has updated its certificate management APIs to support in-place validation modifications.
Cloud engineers no longer need to reissue certificates, reconfigure load balancer endpoints, or update Amazon Resource Names (ARNs) bound to Application Load Balancers (ALBs) or Amazon CloudFront distributions.
As detailed in the official announcement on the AWS Security Blog, administrators can use the UpdateCertificateOptions API to switch an active certificate’s validation method from email to DNS without disrupting live traffic.
When initiating an update through the AWS Management Console or AWS CLI:
- ACM generates a unique, customer-specific CNAME record.
- The administrator publishes this record to their authoritative DNS servers.
- Organizations are granted a 72-hour window to complete DNS propagation, during which the certificate continues active operation under its existing email validation status.
For teams utilizing Amazon Route 53, the ACM console provides a direct one-click workflow to insert required CNAME records into hosted zones automatically. Strengthening authoritative name resolution with modern DNS security solutions helps protect these automated record updates against hijacking.
Migrating from email approvals to DNS validation significantly strengthens cloud security by removing manual human intervention from renewal workflows.
Once the designated CNAME record is verified, ACM automatically reissues and binds renewed certificates before expiration.
For specialized setups utilizing Amazon CloudFront, AWS also supports an HTTP-based token validation path as an alternative automated mechanism for securing TLS communication protocols.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
