SSL CERTIFICATE

If an AWS Certificate Manager (ACM) SSL/TLS certificate covers multiple domains, opting not to renew validation for certain domains may impact the primary domain, depending on the certificate’s configuration.

You may consider:

• Verify ACM Certificate Details → Confirm whether the primary domain is part of a shared certificate.
• Renew Only Required Domains → If feasible, obtain a separate certificate for the primary domain.
• Monitor Expiration Dates → Use AWS CloudWatch or EventBridge to track certificate validity and receive alerts.

Yes, that's what it means. If all the names on your certificate are validated successfully, the certificate will be renewed. If even one of the names fails validation, the whole certificate will fail to be renewed, and all resources using it will stop working (for TLS functionalities).

If you're using DNS validation, as is recommended, you can simply request a new certificate from ACM with only the names you need and can validate. Importantly, the validation CNAME records are the same for each name in each AWS account, so for example, when you see that 2 of the 3 names on your old certificate are validated, requesting a new certificate with those 2 names will cause it to be validated straight away, without having to add or modify CNAME authorisation records in DNS.

Once the new certificate has been issued, you'll need to modify each of your resources using the old certificate to start using the new one. A list of the resources associated with the old certificates is shown in the certificate details page in the console.