AWS Certificate Manager - Certificate Renewal

Question

I received an email saying below:

You have an SSL/TLS certificate from AWS Certificate Manager in your AWS account that expires. This certificate includes the primary domain and a total of 2 domains.

To renew this certificate, you must ensure that the proper CNAME records are present in your DNS configuration for each domain listed below.

I navigated to Route 53 which is I used for the domain and added the CNAME records. The renewal status of the 2 domains changed to Success but the certificate status is still Pending Validation. I've waited but still the status is Pending Validation. Is there a way that I can re-initiate the process?

Thanks in advance.

re:Post Agent · Answer

Based on the information you've provided, it seems you've taken the correct initial steps for renewing your AWS Certificate Manager (ACM) certificate. However, there are a few points to consider and actions you can take:

1. Timing: After adding the CNAME records, it can take some time for the changes to propagate and for ACM to validate the domains. While you mentioned you've waited, it's worth noting that this process can sometimes take up to 72 hours.

2. Certificate Status vs. Domain Status: It's positive that the renewal status for the two domains has changed to "Success". However, the overall certificate status remaining as "Pending Validation" suggests that ACM might still be in the process of finalizing the renewal.

3. Re-initiating the process: Unfortunately, there isn't a direct way to manually re-initiate the validation process once it's started. ACM manages this automatically.

4. Checking CNAME records: Ensure that the CNAME records you've added in Route 53 exactly match the records provided by ACM. Any discrepancies can cause validation issues.

5. Certificate usage: Make sure the certificate is still in use by an AWS service. ACM only automatically renews certificates that are actively being used.

If the status doesn't change after 72 hours, you may want to consider the following actions:

1. Double-check the CNAME records in Route 53 to ensure they're correct and haven't been accidentally modified or deleted.

2. If possible, verify that the CNAME records are publicly resolvable using a DNS lookup tool.

3. Contact AWS Support for further assistance if the issue persists. They can provide more specific guidance based on your account and certificate details.

Remember, as long as you've correctly set up the DNS records and the certificate is in use, ACM should handle the renewal process automatically. If you've followed these steps and are still experiencing issues, reaching out to AWS Support would be the best next step.  
**Sources**  
[AWS Certificate Manager DNS validation - AWS Certificate Manager](https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html)  
[Check a certificate's renewal status - AWS Certificate Manager](https://docs.aws.amazon.com/acm/latest/userguide/check-certificate-renewal-status.html)  
[Renew ACM public certificates - AWS Certificate Manager](https://docs.aws.amazon.com/acm/latest/userguide/renew-publicly-trusted.html)

Steve_M · Answer

The situation you're describing - DNS validation of an ACM Cert where the domain is administered in Route 53 in the same account - should be automatic with no manual steps needed.

Check the **Pending validation** section of https://docs.aws.amazon.com/acm/latest/userguide/check-certificate-renewal-status.html

In particular:

> If you used DNS validation, check to make sure your DNS record exists and that your certificate remains in use.

Is the certificate in use? If it's not in use then it won't be renewed.

AWS Certificate Manager - Certificate Renewal

Add your answer

Relevant content