How do I troubleshoot email validation issues with ACM certificates?

Short description

Important: ACM discontinued WHOIS lookup for email-validated certificates. Use DNS validation instead of email validation.

To renew an ACM certificate, you can use either email-validated renewals or DNS-validated renewals.

Email validation requires ACM to deliver a validation email to an administrative address on your domain. Email validation fails when ACM can't deliver or process the validation email for your domain. If the certificate doesn't move to Issued status, then one of the following symptoms applies:

• You don't receive the validation email.
• The certificate status remains in Pending validation after you approve the email.
• The resend option isn't available or returns an error.
• You can't access the validation email addresses for your domain.

To resolve these issues, identify your scenario and follow the corresponding steps.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Resolve missing validation emails

When you request a certificate with email validation, ACM sends validation emails to five email addresses for each domain on the certificate. Take the following actions.

Verify domain MX records

ACM relies on the domain's MX record to route validation emails. If the MX record is misconfigured or missing, then ACM can't deliver the email.

Run the following command to query the MX record for your domain:

dig MX example.com +short

Confirm that the MX record points to a mail server that's operational and accepts mail.

If your domain doesn't have an MX record, then ACM sends email to the domain itself. For example, admin@example.com. Confirm that the fallback address is reachable.

Check spam and junk folders

ACM sends validation emails from no-reply@certificates.amazon.com. Check your spam, junk, and quarantine folders. If your organization uses an email filtering gateway, then add the no-reply@certificates.amazon.com sender address to the allowlist.

Confirm the correct administrative email addresses

ACM sends validation emails to the following addresses for the domain:

• hostmaster@example.com
• postmaster@example.com
• admin@example.com
• webmaster@example.com
• administrator@example.com

Confirm that at least one of the preceding mailboxes exist and receives email.

Resend the validation email

If the original email was lost or expired, then resend a new validation email.

Note: If you use the resend-validation-email AWS CLI command, then the --validation-domain parameter redirects validation emails to a parent domain. For example, if you validate sub.example.com, then set --validation-domain to example.com to receive the email at the parent domain's administrative addresses.

Resolve a certificate stuck in Pending validation after approval

After you click the approval link in the validation email, ACM processes the approval asynchronously. The certificate status can take up to 30 minutes to update.

If the certificate remains in the Pending validation status after 30 minutes, then complete the following steps:

1. Verify the approval completed. After you click the link, you should see an Amazon confirmation page. If you see an error page, then the approval didn't complete.

2. Check whether the approval link expired. Validation emails contain a link that expires after 72 hours. If the link expired, then resend the validation email and approve again with the new link.

3. Confirm that you approved for all domains. If the certificate covers multiple domain names, then each domain requires separate approval. Check the certificate details in the ACM console and identify the domains that still require validation.

4. Run the following command to check the validation status for each domain:

   aws acm describe-certificate \--certificate-arn arn arn:aws:acm:REGION:111122223333:certificate/12345678-1234-1234-1234-123456789012 \--query 'Certificate.DomainValidationOptions'

   Note: Replace REGION with your AWS Region, 111122223333 with your AWS account ID and 12345678-1234-1234-1234-123456789012 with your certificate ID.

5. In the output, check the ValidationStatus field for each domain. Any domain that still shows Pending validation hasn't been approved yet.

Fix the resend option when it's unavailable or returns an error

When the certificate isn't in a state that accepts validation, the resend option is either unavailable or returns an error.

Take the following actions.

• Check that the certificate status isn't pending_validation.
  Note: You can only resend emails for certificates that are pending validation. If the certificate has been issued, failed, expired, or revoked, then the resend option is unavailable.
• Check that the certificate was requested with DNS validation.
  Note: The resend option only applies to email-validated certificates.
• Check whether the certificate timed out from the pending state.
  Note: ACM certificates that remain in pending_validation for more than 72 hours automatically time out. You must request a new certificate.
• Confirm that the domain name or validation domain is correct in the API call. Also confirm that the --domain and --validation-domain parameters match the certificate's configuration.

Resolve inaccessible or outdated validation email addresses

If the administrative email addresses no longer exist or forward to an unmonitored mailbox, then use one of the following options:

• Set up the required mailbox.
• Use a parent domain for validation.
• Switch to DNS validation.

Set up the required mailbox

Create one of the standard administrative mailboxes on your domain's mail server:

• hostmaster@example.com
• postmaster@example.com
• admin@example.com
• webmaster@example.com
• administrator@example.com

Configure the mailbox to receive mail, and then resend the validation email.

Use a parent domain for validation

If you validate a subdomain, for example, app.example.com, and can't receive email at that subdomain, then redirect the validation email to the parent domain.

Run the following request-certificate command with the ValidationDomain option set to the parent domain:

aws acm request-certificate \--domain-name app.example.com \--validation-method EMAIL \--domain-validation-options DomainName=app.example.com,ValidationDomain=example.com

This sends the validation email to the administrative addresses at example.com instead.

Switch to DNS validation

DNS validation proves domain ownership through a CNAME record in your domain's DNS configuration instead of an email response. To switch to DNS validation, request a new certificate and select DNS as the validation method.

Important: When you request a new certificate with DNS validation, ACM generates a new Amazon Resource Name (ARN). Update any services that use the previous certificate to reference the new ARN.

Related information

Troubleshoot managed certificate renewal

Managed certificate renewal in AWS Certificate Manager

Check a certificate's renewal status

Why is my ACM certificate renewal status still "Pending validation" after I used the ACM managed renewal process for my domain name?

Why can't I resend the validation email from ACM to renew a certificate?