AWS Certificate Manager (ACM) has announced a phased plan to discontinue email-based domain control validation (DCV) for public certificate renewals, culminating in a complete cessation by September 30, 2027. This strategic move aligns with global trust mandates set forth by the Certificate Authority and Browser (CA/B) Forum, urging organizations to transition to DNS validation methods.
The CA/B Forum’s decision in November 2025 to eliminate email-based domain validation for public TLS/SSL certificates has set a clear timeline: starting March 15, 2028, major web browsers will no longer trust any public certificate validated through email verification, irrespective of the issuing Certificate Authority. This shift underscores the industry’s recognition of the vulnerabilities associated with email validation, such as compromised mail exchange (MX) routing and intercepted verification links, which pose significant supply-chain risks.
AWS’s Phased Implementation Plan
To ensure a seamless transition and safeguard customer workloads from potential certificate renewal failures ahead of the 2028 browser distrust deadline, AWS has outlined a multi-stage phaseout schedule:
- January 1, 2027: Email validation will be restricted in newly launched AWS Regions.
- March 31, 2027: Email validation will be prohibited for newly requested certificates across all AWS Regions.
- September 30, 2027: Complete termination of email-based automated renewals in ACM.
- March 15, 2028: Global CA/B Forum deadline, after which major browsers will distrust all email-validated certificates.
To facilitate this transition without necessitating infrastructure changes, AWS has enhanced its certificate management APIs. Administrators can now use the `UpdateCertificateOptions` API to modify an active certificate’s validation method from email to DNS seamlessly. This update eliminates the need to reissue certificates, reconfigure load balancer endpoints, or update Amazon Resource Names (ARNs) associated with Application Load Balancers (ALBs) or Amazon CloudFront distributions.
When initiating an update through the AWS Management Console or AWS CLI, ACM generates a unique CNAME record. Administrators are required to publish this record to their authoritative DNS servers. A 72-hour window is provided to complete DNS propagation, during which the certificate remains active under its existing email validation status. For users of Amazon Route 53, the ACM console offers a streamlined, one-click workflow to automatically insert the necessary CNAME records into hosted zones.
Transitioning from email approvals to DNS validation enhances cloud security by removing manual human intervention from renewal workflows. Once the designated CNAME record is verified, ACM automatically reissues and binds renewed certificates before expiration. For specialized configurations utilizing Amazon CloudFront, AWS also supports an HTTP-based token validation method as an alternative mechanism for securing TLS communication protocols.
This proactive approach by AWS not only aligns with industry standards but also fortifies the security posture of organizations by mitigating risks associated with email-based validation methods. Organizations are encouraged to begin the transition process promptly to ensure compliance and maintain uninterrupted service.
