# Ensure ACM certificates do not expire within 7 days - Source: https://support.icompaas.com/support/solutions/articles/a_1793292185297428-ensure-acm-certificates-do-not-expire-within-7-days - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that no AWS Certificate Manager (ACM) certificate in use expires within the next 7 days or has already expired. Certificates that do not yet have an expiry date, for example because their validation is pending or has failed, are treated as expiring in 0 days and are also flagged. Only certificates in use are evaluated. Certificates close to expiry must be renewed or replaced before their end date so that the services using them continue to work. **Rationale** When a TLS certificate expires, browsers and API clients reject connections to the load balancers, CloudFront distributions and API Gateway domains that use it, causing service outages and failed API calls. Last-minute fixes during an outage also increase the risk of mistakes, such as disabling certificate verification. Detecting expiring certificates early allows them to be renewed or replaced in a planned way. **Impact** - Prevents outages caused by expired certificates - Avoids emergency changes that may weaken TLS security - Replacing an imported certificate requires obtaining a new certificate from the issuing certificate authority **Default Value** ACM-issued certificates are renewed automatically before expiry, provided they are in use and their domain validation is still valid. Imported certificates are never renewed automatically and must be re-imported before they expire. **Pre-Requisites** - IAM permissions: acm:ListCertificates, acm:DescribeCertificate and acm:ImportCertificate - For ACM-issued certificates: access to update the DNS records used for domain validation - For imported certificates: a new certificate, private key and certificate chain from the certificate authority **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Certificate Manager (ACM) console. 3. Review the **Expires on** (or **Not after**) date and the **In use** value of each certificate. 4. Repeat for each region in use. Certificates used by CloudFront are in the **US East (N. Virginia)** region. 5. If any certificate in use expires within 7 days, has already expired or has no expiry date, follow the implementation steps. **CLI:** List all certificates with their type, usage and expiry date: aws acm list-certificates --region --includes keyTypes=RSA\_1024,RSA\_2048,RSA\_3072,RSA\_4096,EC\_prime256v1,EC\_secp384r1,EC\_secp521r1 --query "CertificateSummaryList\[\].\[DomainName,Type,InUse,NotAfter,CertificateArn\]" --output table A certificate fails if it is in use and its NotAfter date is within 7 days or already in the past, or if it is in use and has no NotAfter value (for example pending or failed validation). Certificates that are not in use are not evaluated. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Certificate Manager (ACM) console and select the expiring certificate. 3. If the certificate type is **Amazon issued**: - check the **Domains** section and confirm the validation status is **Success**, - if validation has failed, create the shown CNAME record in your DNS (or choose **Create records in Route 53**) so that ACM can renew the certificate. 4. If the certificate type is **Imported**: - choose **Reimport certificate**, - paste the new certificate body, private key and certificate chain, - choose **Review and import**, then **Import**. 5. If a new certificate was requested instead of renewing the old one, attach it to each service that uses the old one (load balancer listener, CloudFront distribution or API Gateway custom domain). 6. Repeat for each expiring certificate in each region in use. **Backout Plan** Before reimporting, keep a copy of the current certificate, private key and certificate chain. 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Certificate Manager (ACM) console and select the certificate. 3. Choose **Reimport certificate** and paste the previous certificate body, private key and certificate chain. 4. Choose **Review and import**, then **Import**. 5. If a service was moved to a new certificate, select the previous certificate again in that service's settings. Note: renewal of an ACM-issued certificate cannot be reversed, and none is needed. Rolling back an imported certificate is only possible while the previous certificate is still valid. **Reference** - [https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html](https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html) - [https://docs.aws.amazon.com/acm/latest/userguide/import-reimport.html](https://docs.aws.amazon.com/acm/latest/userguide/import-reimport.html) - [https://docs.aws.amazon.com/config/latest/developerguide/acm-certificate-expiration-check.html](https://docs.aws.amazon.com/config/latest/developerguide/acm-certificate-expiration-check.html) - [https://docs.aws.amazon.com/cli/latest/reference/acm/list-certificates.html](https://docs.aws.amazon.com/cli/latest/reference/acm/list-certificates.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.