How do I get notified when my ACM certificate is about to be renewed?

Short description

To set up ACM certificate renewal notifications, first check the certificate's eligibility for automatic renewal. Then, take one or more of the following actions:

• Estimate your certificate's renewal date
• Configure advanced notice before renewal
• Configure notifications for failed renewal

Resolution

Check your certificate's eligibility for automatic renewal

Complete the following steps:

1. Open the ACM console in your certificate's AWS Region.
2. Choose List certificates.
3. Select your certificate ID, and then open the certificate's Details page.
4. For Certificate status, verify that Type is either Amazon Issued or Private.
   Note: If Type is Imported, then the certificate isn't eligible for ACM managed renewal. To set up notifications for this type of certificate, see How can I be notified when my ACM imported certificates are near expiration?
5. For Details, check whether Renewal eligibility is Eligible or Ineligible.

For information about certificates that are ineligible for managed renewal, see Managed renewal for ACM certificates. Check whether the certificate that's ineligible for managed renewal is associated with an AWS service resource that integrates with ACM. For ACM issued private certificates, associate the certificate to a resource that integrates with ACM, or export it with the ExportCertificate API. For ACM issued public certificates, associate the certificate to a resource that integrates with ACM.

Estimate your certificate's renewal date

Complete the following steps:

1. On your certificate's Details page, note the Not after value that's the date when your certificate expires.
2. For Domains, verify the certificate's validation method:
   If Domains is Registered owners, then it's an email-validated certificate. ACM sends an email notification 45 days before the expiration date that includes actions that you must take to renew your certificate. If you don't take action, then the certificate expires and is no longer eligible for renewal.
   If Domains is CNAME name and CNAME value, then it's a DNS-validated certificate that automatically renews 60 days before expiration.
   If Domains is neither of the preceding values, then check the Certificate Authority (CA). If it has an Amazon Resource Name (ARN), then it's a private certificate from AWS Private Certificate Authority that automatically renews 60 days before expiration. Private certificates don't need domain validation. Instead, ACM requires AWS Private CA permissions for managed renewal. For more information, see Assign certificate renewal permissions to ACM.
3. For email-validated certificates, calculate the date 45 days before your certificate expires. For DNS-validated and private certificates, calculate the date 60 days before your certificate expires.

Configure advance notification before renewal

To receive renewal notifications before the automated 45 or 60 days, either run acm-certificate-expiration-check or use the DaysToExpiry metrics and an Amazon CloudWatch alarm.

Note: The acm-certificate-expiration-check rule checks all certificates in the Region where you create the rule. It uses the common value of daysToExpiration. To monitor and receive notifications for a specific certificate, use DaystoExpiry and a CloudWatch alarm instead.

Run acm-certificate-expiration-check

Complete the following steps:

1. Open the AWS CloudFormation console.
2. Choose Create stack.
3. Choose Choose an existing template.
4. For Amazon S3 URL, enter http://s3.amazonaws.com/aws-configservice-us-east-1/cloudformation-templates-for-managed-rules/ACM_CERTIFICATE_EXPIRATION_CHECK.template.
5. Choose Next.
6. Enter a Stack name, and then for daysToExpiration, enter the number of days that you want to be notified before the expiration.
7. Choose Next.
8. Confirm the configuration settings, and then choose Next.
9. Choose Submit.
10. Verify that the stack's Status is CREATE_COMPLETE.
11. Open the Amazon EventBridge console.
12. Choose Create rule.
13. For Name, enter a rule name.
14. For Description, enter a rule description.
15. Choose Next.
16. For Event pattern, configure the following settings:
    For Event source, choose AWS services.
    For AWS service, select Config.
    For Event type, select Config Rules Compliance Change.
    For Event Type Specification 1, enter ComplianceChangeNotification.
    For Event Type Specification 2, enter the rule name.
    Note: The CloudFormation template's default config rule name is acm-certificate-expiration-check.
17. Choose Next.
18. For Select target(s), select your preferred target for notification for example: SNS Topic in AWS service.
19. Choose Next.
20. Validate the configuration settings, and then choose Create rule.

Example EventBridge rule:

{  
  "source": ["aws.config"],  
  "detail-type": ["Config Rules Compliance Change"],  
  "detail": {  
    "messageType": ["ComplianceChangeNotification"],  
    "configRuleName": ["acm-certificate-expiration-check"]  
  }  
}

Use DaysToExpiry and a CloudWatch alarm

Complete the following steps:

1. Open the CloudWatch console.
2. For Alarms, choose All alarms.
3. Choose Select metric.
4. In the search box, enter DaysToExpiry and your certificate's ARN.
5. In the search result, choose CertificateManager > Certificate Metrics.
6. Select DaysToExpiry for your certificate.
7. Choose Select metric.
8. Under Specify metric and conditions, for Statistics, choose Maximum.
9. For Conditions, choose Lower/Equal.
10. For than, enter the number of days that you want to be notified before the expiration.
11. Choose Next.
12. For Configure actions, select the options for your use case.
13. Choose Next.
14. For Add name and description, enter a name for your alarm, and then choose Next.
15. Confirm the configuration settings, and then choose Create alarm.

Configure notifications for failed renewal

Use an EventBridge rule to send a notification when ACM invokes an ACM Certificate Approaching Expiration event.

Complete the following steps:

1. Open the EventBridge console.

2. Choose Create rule.

3. For Name, enter a rule name.

4. For Description, enter a rule description.

5. Choose Next.

6. Under Event pattern, choose Edit pattern.

7. Enter the following event pattern:

   {
     "source": ["aws.acm"],
     "resources": ["arn:aws:acm:region:account:certificate/CERTIFICATE_ID"],
     "detail-type": ["ACM Certificate Approaching Expiration"]
   }

   Note: Replace region with your Region, account with your AWS account, and CERTIFICATE_ID with your certificate ID.

8. Choose Next.

9. For Select target(s), choose your preferred target for notification, for example: SNS Topic in AWS service.

10. Choose Next.

11. Confirm the configuration settings, and then choose Create rule.

Related information

Handling failures in managed certificate renewal

Monitoring and logging AWS Certificate Manager

Getting started with Amazon Simple Notification Service (Amazon SNS)

Amazon EventBridge support for ACM