AWS will discontinue email validation for public certificates in AWS Certificate Manager (ACM) by September 30, 2027. The cutoff follows the CA/B Forum’s move to end email-based domain validation, with earlier milestones in new Regions on January 1, 2027 and for new requests on March 31, 2027.
The old workflow depended on mailbox links proving control of a domain. ACM is replacing that with DNS validation, which uses a DNS record instead of email, so renewals that once worked by clicking a message in a mailbox will stop being issued once the migration deadline passes.
For teams that run web-facing services on ACM public certificates, the failure mode is deferred: existing certs keep working until renewal time, then can age into browser trust failures if they were never moved off email validation.