How does the ACM managed renewal process work with DNS-validated certificates?

Resolution

Managed renewal eligibility

ACM manages the renewal of your ACM certificates. If the AWS service that you use for your certificate is integrated with ACM, then the certificate is eligible for renewal. ACM automatically renews DNS-validated certificates.

ACM doesn't provide managed renewal for imported certificates, expired certificates, or private certificates that AWS Private Certificate Authority issues with the IssueCertificate API call. However, ACM does provide managed renewal for private certificates that AWS Private CA issues from the ACM console.

Action required by domain owner

ACM certificates are valid for 13 months (395 days). ACM provides you with CNAME records that you must add to your DNS provider's database. The CNAME records contain a name and value that points to an AWS domain. ACM uses the CNAME record with the same ARN to automatically renew DNS-validated certificates 60 days before the expiration.

If ACM fails to renew your DNS-validated certificate, then the CNAME record is missing or incorrect. For more information, see Managed certificate renewal for DNS-validated certificates and Troubleshoot DNS validation problems.

Related information

How does the ACM managed renewal process work with email-validated certificates?

Why is my ACM certificate renewal status still "Pending validation" after I used the ACM managed renewal process for my domain name?

Why did my publicly trusted ACM certificate fail managed renewal?