Verify alert email associated with expiring TLS certificates in ACM

1

We have had some outages due to expired TLS certificates. My understanding is that AWS auto-renews these certificates, and if there is a problem with the auto-renewal then an email alert is sent. My question, is there a way to check which email is receiving these alerts? In our case, the application teams have apparently not received these alerts, and we would like to ensure the appropriate personnel receive alerts for expiring certificates so that they can be renewed before an outage occurs. Any information on other ways to be alerted would be greatly appreciated.

joeyp
preguntada hace un año281 visualizaciones
1 Respuesta
1
Respuesta aceptada

It would be better to set up alerts in the manner described in this document.
This setting allows for alert notifications in a set number of days before the expiration date.
https://repost.aws/knowledge-center/acm-certificate-expiration

Alternatively, since ACM publishes metrics to CloudWatch, it is possible to create an alarm with "DaysToExpiry" to be aware of expiry dates.
https://docs.aws.amazon.com/acm/latest/userguide/cloudwatch-metrics.html

profile picture
EXPERTO
respondido hace un año
profile picture
EXPERTO
revisado hace un año
  • Thank you for the answer! Does this solution work for AWS issued certificates or only imported certificates?

  • Both of the ones above are also supported. The "DaysToExpiry" metric supports both imported and AWS-issued certificates.

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas