Cloud · 45 days ago

AWS ACM Drops Email Validation by 2027

AWS will discontinue email validation for public certificates in AWS Certificate Manager (ACM) by September 30, 2027. The cutoff follows the CA/B Forum’s move to end email-based domain validation, with earlier milestones in new Regions on January 1, 2027 and for new requests on March 31, 2027.

The old workflow depended on mailbox links proving control of a domain. ACM is replacing that with DNS validation, which uses a DNS record instead of email, so renewals that once worked by clicking a message in a mailbox will stop being issued once the migration deadline passes.

For teams that run web-facing services on ACM public certificates, the failure mode is deferred: existing certs keep working until renewal time, then can age into browser trust failures if they were never moved off email validation.

Timeline

• Aug 14 Reported by Help Net Security
• Aug 13 Reported by AWS Security Blog

Sources

2 sources covering this story

• Help Net Security Aug 14

  AWS Certificate Manager sets 2027 end date for email-validated certificate renewals - Help Net Security

  AWS Certificate Manager will stop renewing email-validated certificates in September 2027.

• AWS Security Blog Aug 13

  AWS Certificate Manager will discontinue email validation to prove domain validation for certificates | Amazon Web Services

  Today, we’re announcing that AWS Certificate Manager (ACM) will discontinue support for email-validated public certificates by September 30, 2027.

Part of the PlainSec briefing for 2026-08-15

Editions

• Briefing for 2026-08-15
• Briefing for 2026-08-14