Cloud platform · checked November 15, 2026

Is AWS Certificate Manager ready for 100-day and 47-day certificates?

Automatic only in some setups

Partly. Some AWS Certificate Manager setups renew and install certificates automatically; others need you to act every cycle. See which one you have below.

What renews automatically

• ACM certificates are valid for 198 days.[AWS]
• DNS-validated certificates renew automatically 45 days before expiry, if they're in use by an AWS service and the ACM DNS CNAME records are still present. Older 395-day certificates renew 60 days before.[AWS 1 (AWS Certificate Manager User Guide — Renewal for domains validated by DNS), 2 (AWS Certificate Manager User Guide — Managed certificate renewal)]

What doesn’t

• Email-validated certificates need the domain owner to act on renewal emails, which start 45 days before expiry.[AWS]
• Imported certificates get no managed renewal. You reimport each new certificate.[AWS]
• Certificates issued through ACM's ACME support are renewed by your ACME client, not by ACM.[AWS]

When it renews

45 days before expiry for 198-day certificates.[AWS]

What to do, and by when

1. March 15, 2027 · In 120 days
   Maximum certificate lifetime drops to 100 days[CA/Browser Forum 1 (CA/Browser Forum — Baseline Requirements for TLS Server Certificates (v2.3.1, 4 Oct 2026)), 2 (CA/Browser Forum — Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods)]
   Move imported and email-validated certificates to DNS-validated ACM certificates.

Steps

1. In the ACM console, list certificates and check the "Renewal eligibility" and validation method.
2. For email-validated certificates, request a DNS-validated replacement.
3. For imported certificates, either automate the reimport or switch to an ACM-issued certificate.