AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
AWS Certificate Manager failing to renew certificates - for 0 domains?
Hello everyone,
I keep receiving the following email from AWS Certificate Manager. It says that it has failed to automatically renew a certificate. However, I have checked (and re-applied) CNAME records, and all are fine. Moreover, the email says, "The following 0 domains require validation:".
On my AWS Management Console, the status of the certificate in question is "Pending auto-renewal".
Following some other posts on this forum, I have updated my CAA record as follows:
0 issuewild "amazon.com"
0 issue "amazon.com"
0 issue "amazontrust.com"
0 issue "awstrust.com"
0 issue "amazonaws.com"
However, I cannot manually trigger a certificate renewal. Would this also work for my sub-domains (CNAMEs)?
You have an SSL/TLS certificate from AWS Certificate Manager in your AWS account that expires on May 13, 2025 at 23:59:59 UTC. This certificate includes the primary domain taskbridge.app and a total of 3 domains.
AWS account ID: REDACTED AWS Region name: us-east-1 Certificate identifier: arn:aws:acm:us-east-1:REDACTED:certificate/REDACTED
AWS Certificate Manager (ACM) was unable to renew the certificate automatically using DNS validation. You must take action to ensure that the renewal can be completed before May 13, 2025 at 23:59:59 UTC. If the certificate is not renewed and the current certificate expires, your website or application may become unreachable.
To renew this certificate, you must ensure that the proper CNAME records are present in your DNS configuration for each domain listed below. You can find the CNAME records for your domains by expanding your certificate and its domain entries in the ACM console. You can also use the DescribeCertificate command in the ACM API[1] or the describe-certificate operation in the ACM CLI[2] to find a certificate’s CNAME records. For more information, see Automatic Domain Validation Failure in the ACM troubleshooting guide[3]. The following 0 domains require validation:
- Language
- English
asked a year ago459 views
- Newest
- Most votes
- Most comments
What are you using to validate the CNAME? Route 53, Cloudflare, or another DNS provider? Recreate the CNAME records (even if they look correct) — "don’t edit, delete and recreate them", as this usually speeds up propagation. These CAA records are valid for both the root domain and subdomains, as long as there isn’t a specific CAA entry blocking a subdomain:
0 issue "amazon.com" 0 issue "amazontrust.com" 0 issue "awstrust.com" 0 issue "amazonaws.com"
answered a year ago
The issue you're experiencing with AWS Certificate Manager (ACM) failing to renew your certificate despite showing "0 domains require validation" is likely due to a Certification Authority Authorization (CAA) error. This can occur even if you've set up the CAA records correctly.
To address this:
-
Verify that your CAA records are correctly set up in your DNS configuration. The records you've added look correct, but ensure they are properly implemented for your domain and subdomains.
-
Check if there are any other CAA records that might be conflicting with the ones you've added.
-
The CAA records you've set should work for your subdomains (CNAMEs) as well, but double-check that they are applied at the correct level in your DNS hierarchy.
-
Since the certificate is in "Pending auto-renewal" status, ACM is still attempting to renew it automatically. You cannot manually trigger a renewal, but you can monitor the status in the ACM console or using the AWS CLI.
-
Use the AWS CLI to get more detailed information about the renewal status. Run the describe-certificate command with your certificate's ARN. Look for the "RenewalSummary" section in the output, which may provide more specific information about why the renewal is failing.
-
Ensure that your certificate is associated with an AWS service that's integrated with ACM, as this is a requirement for automatic renewal.
-
Verify that all the required CNAME records for DNS validation are present and accessible via public DNS for each domain in your certificate.
If the issue persists after checking these points, you may need to contact AWS support for further assistance. They can provide more specific guidance based on your account and certificate details.
Sources
Certificate renewal fails: DNS correctly set and email contains 0 domains to validate, but domain is waiting for auto-renewal | AWS re:Post
Problem for CAA certificate renewal in ACM | AWS re:Post
Troubleshoot managed certificate renewal - AWS Certificate Manager
Renewal for domains validated by DNS - AWS Certificate Manager
answered a year ago
I guess it must be the CAA. Using the AWS cli, I can see that all sub-domains were validated successfully, however there is a CAA error:
"RenewalStatusReason": "CAA_ERROR",
"UpdatedAt": "2025-05-12T12:40:56.055000+01:00"
This time is after my changes to CAA as described above.
answered a year ago
Relevant content
asked 3 years ago
asked 2 years ago
My zone records are all in Route 53. I did in fact re-create the CNAME records (first I tried just editing them, then I deleted them and re-created them from scratch). Perhaps I'll just have to wait till tomorrow to see whether my certificate renews! gnaws nails nervously