# Ensure ACM Certificates are about to expire in specific days or less

- Source: https://support.icompaas.com/support/solutions/articles/62000236261-ensure-acm-certificates-are-about-to-expire-in-specific-days-or-less
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Profile Applicability:**

-   Level 1

###   

### **Description:**

This control ensures that all AWS Certificate Manager (ACM) certificates — whether issued by AWS or imported — are actively monitored for expiration within a specific number of days (e.g., 30 days or less). Certificates nearing expiration can cause service interruptions, broken HTTPS connections, and compliance violations. Establishing alerts before expiry helps ensure timely renewal or replacement.

###   

### **Rationale:**

Monitoring certificate expiration dates is essential to maintaining secure, uninterrupted encrypted connections (HTTPS, TLS). Expired certificates can lead to:

-   Application downtime and broken integrations.
    
-   Customer trust issues due to SSL/TLS validation errors.
    
-   Non-compliance with security frameworks (CIS, SOC 2, ISO 27001, PCI-DSS).
    

Implementing monitoring and alerts for certificates nearing expiration helps ensure proactive management and uninterrupted service availability.

  

### **Impact:**

-   Positive Impact:Prevents accidental certificate expiration and downtime.Improves compliance and operational continuity.Ensures encrypted communications remain secure and trusted.
-   Negative Impact:Minimal administrative effort to review and renew certificates before expiry.

  

### **Default Value:**

By default, AWS ACM automatically renews ACM-managed certificates (issued by Amazon) 60 days before expiry if domain validation remains valid.  
However, imported certificates must be manually renewed before expiration — ACM does not auto-renew these.

  

### **Pre-Requisite:**

-   IAM permissions required:
    
    -   `acm:ListCertificates`
        
    -   `acm:DescribeCertificate`
        
-   AWS CLI installed or access to AWS Management Console.
    
-   Optional: Amazon SNS topic or AWS Lambda function for automated alerts.
    

###   

### **Remediation**

#### **Test Plan**

#### **Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to Certificate Manager (ACM).
    
3.  Review the Expiration date column.
    
4.  Identify certificates expiring in the next _N_ days (e.g., 30 days or less).
    
5.  For ACM-managed certificates, confirm that automatic renewal is active.
    
6.  For imported certificates, verify that renewal is planned before expiry.
    

###   

### **Implementation Plan**

#### **Using AWS Console:**

1.  Navigate to ACM → Certificates.
    
2.  Sort or filter the list by Expiration date.
    
3.  Identify certificates expiring within the next 30 days.
    
4.  For certificates issued by ACM:
    
    -   Confirm domain validation records (CNAME or DNS validation) are still valid for auto-renewal.
        
5.  For imported certificates:
    
    -   Re-import a renewed certificate or request a new one before expiration.
        
6.  Optionally, configure a CloudWatch metric filter or Lambda script to monitor certificate expiration and send alerts via SNS or email.
    

###   

### **Backout Plan**

#### **Using AWS Console:**

-   If a certificate is mistakenly replaced or renewed, revert to the previous version by restoring the old certificate (if still valid) using ACM → Import certificate.
    

  

  

### **References:**

-   [AWS Certificate Manager Documentation](https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html)
    
-   [AWS CLI Command Reference – ACM](https://docs.aws.amazon.com/cli/latest/reference/acm/index.html)
    
-   [AWS CloudWatch Alarms for ACM Certificates](https://docs.aws.amazon.com/acm/latest/userguide/monitoring-acm.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.