- Newest
- Most votes
- Most comments
The strongly recommended way to authorise the issuance of certificates by ACM is to use DNS validation. It's explained in this documentation section: https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html
In addition to avoiding issues with email delivery and manual mistakes, DNS validation is generally more secure and importantly allows ACM to renew the certificate automatically, avoiding unnecessary outages for your service, for as long as the CNAME record exists, after you've added it as a one-time action in your public DNS zone.
Also, over time, the maximum validity period for publicly trusted certificates has been decreased repeatedly. Currently, the maximum duration is 13 months, but it's entirely possible for it to be decreased later. With DNS validation, you won't be impacted and manual effort won't increase, and everything will continue working in a fully automated manner courtesy of AWS.
In short, when requesting a certificate in ACM, simply choose DNS as the validation method, and add the CNAME record(s) that the console provides in your public DNS zone.
What's the renewal status of the certificate in the AWS Console? https://docs.aws.amazon.com/acm/latest/userguide/check-certificate-renewal-status.html#check-renewal-status-console
Also, is the certificate still in use? By that I mean it's associated with an AWS service like a load balancer or a CloudFront distribution. If it's not in use then it won't be renewed.
Relevant content
asked 4 years ago
asked 4 years ago
