Why is my ACM certificate renewal status still "Pending validation" after I used the ACM managed renewal process for my domain name?

Short description

If ACM can't automatically validate one or more domain names in the certificate, then the renewal status is Pending validation.

The following reasons cause the renewal status to remain in Pending validation:

• One of the domains in an ACM certificate isn't validated.
• The Certification Authority Authorization (CAA) record blocks the renewal.
• The automatic validation failed.
• The managed renewal process hasn't completed yet.
• The original certificate has expired.
• DNSSEC configuration issues block the renewal.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

To check whether a domain is validated, expand the certificate details in the ACM console. Or run the describe-certificate command in the AWS CLI.

Then, use the following steps to troubleshoot based on your scenario.

• For email-validated certificate renewals, ACM begins to send renewal notices 45 days before the certificate expires. The notices include actions that you must take to renew your certificate.
• For DNS-validated certificate renewals, ACM checks that certain criteria are met 45 days before the certificate expires to automatically renew your ACM certificates.
  Note: ACM renewal timing depends on the certificate's validity period. Certificates with a 395-day validity period renew 60 days before expiration and receive a renewed validity period of 198 days. Certificates with a 198-day validity period renew 45 days before expiration.

One of the domains in an ACM certificate isn't validated

If you manually validate domains, then you must validate each domain in the ACM certificate.

If you use email validation, then ACM sends a set of validation emails for each domain. To validate the domains, complete the steps in the emails.

The CAA record blocks the renewal

If you configured a CAA record to allow ACM to issue your certificate, then confirm that the issuance didn't block the renewal. To resolve this issue, see How do I resolve CAA Failed error when an ACM certificate is issued or renewed?

The automatic validation failed

If ACM can't automatically validate a domain, then see Handling failures in managed certificate renewal.

The managed renewal process hasn't completed yet

It can take up to a few hours for ACM to obtain the new certificate. During this time, the status in the ACM console remains Pending validation.

If the update is delayed, then the domain's validation status in the ACM console is Success and the certificate's renewal status is Pending validation.

The original certificate has expired

If the original email-validated ACM certificate expires, then the certificate status changes from Issued to Pending validation. You must validate the domain within 72 hours, or the renewal status changes from Pending validation to Failed.

If the renewal fails, then you must request another public certificate for the domains.

DNSSEC configuration issues block the renewal

If your domain had DNSSEC turned on, then check that the DNSSEC deployment is correctly configured. When the DNSSEC chain is broken or misconfigured, DNSSEC validation fails and the CA can't resolve any DNS records for the domain. This blocks ACM domain validation.

Check for the following issues:

• Expired DNSSEC signatures
• Missing DS records
• Mismatched keys between the zone signing key and the DS record in the parent zone.
  Note: Domains without DNSSEC configured are not affected. When ACM queries a domain without DNSSEC, ACM classifies the response as insecure and issuance proceeds normally.

For more information, see Why didn't the CNAME record resolve for my ACM issued certificate and the DNS validation status is still "Pending validation"?

Related information

Managed certificate renewal in ACM

Check a certificate's renewal status

Why did my publicly trusted ACM certificate fail managed renewal?