AWS Phasing Out Email Validation for Public Certificates

AWS Certificate Manager (ACM) has announced a significant change in its certificate validation procedures, with plans to permanently end email-based domain control validation (DCV) for public certificates by September 30, 2027. This decision is part of an effort to align with global trust mandates set by the Certificate Authority and Browser (CA/B) Forum, necessitating cloud architects, DevOps engineers, and security teams to shift from legacy email validation to DNS validation methods.

The Move Toward DNS Validation

The transition follows a pivotal decision made by the CA/B Forum in November 2025 to phase out email validation for public TLS/SSL certificates. By March 15, 2028, major web browsers will no longer trust any certificate validated via email, regardless of the issuing Certificate Authority (CA). The cryptographic community has long criticized email validation for its vulnerabilities, including compromised mail exchange (MX) routing and outdated WHOIS contacts, which pose significant supply-chain risks.

To mitigate potential certificate renewal failures and ensure compliance with upcoming standards, AWS has laid out a phased plan. Starting January 1, 2027, email validation will be restricted in new AWS regions, and by March 31, 2027, it will be prohibited for all new certificate requests across AWS regions. The complete cessation of email-based renewals will occur by September 30, 2027.

Simplified Transition Process

AWS has updated its certificate management APIs to facilitate a seamless transition to DNS validation. Users can modify validation methods in-place without the need to reissue certificates or reconfigure existing infrastructure components. The UpdateCertificateOptions API allows administrators to change a certificate’s validation from email to DNS, minimizing disruptions to live traffic.

When initiating a DNS update, ACM generates a unique CNAME record, which administrators must publish to their authoritative DNS servers. Organizations have a 72-hour window to complete DNS propagation, during which the certificate remains operational under its current validation status. For Amazon Route 53 users, the ACM console provides a one-click option to automatically insert CNAME records into hosted zones.

Enhancing Cloud Security

Switching to DNS validation enhances cloud security by eliminating manual processes from certificate renewal workflows. Once the CNAME record is verified, ACM automatically reissues and binds renewed certificates before they expire. For setups involving Amazon CloudFront, AWS also offers an HTTP-based token validation as an alternative method for securing TLS communication.

The shift from email to DNS validation is a critical step in bolstering cloud security and complying with industry standards. By adopting these measures, organizations can ensure their certificate management processes remain robust against potential threats.

As AWS continues to refine its security protocols, the focus remains on providing customers with reliable and secure certificate management solutions, paving the way for a more secure digital infrastructure.