AWSTroubleshootingIntermediate

Sev1: HTTPS down — ACM certificate expired or renewal failed

Restore HTTPS on ALB, CloudFront or API Gateway when an ACM certificate expires. Understand why managed renewal failed (DNS validation records, imported certificates, CAA), issue a replacement fast and alert before it happens again.

Deepak Bhardwaj24 Oct 20262 min read

Applies toAWS Certificate Manager, Application/Network Load Balancer, CloudFront, API Gateway, AWS CLI v2

Symptoms

Browsers show NET::ERR_CERT_DATE_INVALID; API clients fail TLS handshakes.
openssl s_client shows an expired notAfter.

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null | openssl x509 -noout -dates -issuer

1. Which certificate and why

aws acm list-certificates --certificate-statuses EXPIRED ISSUED --query "CertificateSummaryList[].[DomainName,CertificateArn,Status]" --output table

aws acm describe-certificate --certificate-arn <arn> \
  --query "Certificate.{type:Type, status:Status, notAfter:NotAfter, renewal:RenewalSummary, eligible:RenewalEligibility, inUse:InUseBy}"

CloudFront certificates live in us-east-1; add --region us-east-1.

Finding	Cause
`Type: IMPORTED`	ACM never renews imported certificates — you must re-import
`RenewalSummary.RenewalStatus: PENDING_VALIDATION`	DNS validation CNAME removed or changed
Email validation, nobody clicked	Renewal email went to an unmonitored mailbox
`RenewalEligibility: INELIGIBLE`	Certificate not in use by an integrated service
CAA record forbids Amazon	`CAA` must allow `amazon.com` (or `amazontrust.com`)

2. Fix the validation record (managed certificate)

aws acm describe-certificate --certificate-arn <arn> \
  --query "Certificate.DomainValidationOptions[].ResourceRecord" --output table

Re-create the CNAME in Route 53 (or your DNS provider) exactly as shown. ACM retries validation automatically; this can take some time.

3. Fastest restore: request a new certificate

If renewal won't complete quickly, issue a new one and swap it on the listener:

aws acm request-certificate --domain-name www.example.com --subject-alternative-names example.com \
  --validation-method DNS
# create the validation CNAMEs, wait for ISSUED
aws acm wait certificate-validated --certificate-arn <new-arn>

aws elbv2 modify-listener --listener-arn <https-listener-arn> \
  --certificates CertificateArn=<new-arn>

For CloudFront, update the distribution's viewer certificate; for API Gateway custom domains, update the domain name's certificate ARN.

4. Imported certificates

aws acm import-certificate --certificate-arn <existing-arn> \
  --certificate fileb://cert.pem --private-key fileb://key.pem --certificate-chain fileb://chain.pem

Re-importing to the same ARN updates every service using it without changing their configuration.

Tip
Re-import with the full intermediate chain. Missing intermediates break older clients and Java truststores even when browsers look fine.

Prevent it next time

Prefer ACM-issued certificates with DNS validation; keep validation CNAMEs in IaC.
EventBridge rule on ACM Certificate Approaching Expiration events to on-call.
AWS Config managed rule acm-certificate-expiration-check.
Track imported certificates separately; they have no auto-renewal.