How do I resolve automatic renewal failures of my private certificate in ACM?

Short description

ACM automatically tries to renew eligible private certificates 60 days before expiration.

The automatic renewal of private certificates might fail in the following situations:

• The private certificate isn't eligible for managed renewal.
• ACM doesn't have permissions on the private CA.
• The private certificate isn't in an active state.
• The ACM service-linked role (SLR) is missing in the AWS account where the certificate resides.
  Note: Private certificates don't require domain validation. Trust is established when an administrator installs the appropriate root CA certificate in client trust stores.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Verify that the certificate is eligible for managed renewal

Confirm that the certificate meets the requirements for automatic renewal. If your certificate isn't eligible for managed renewal, then you can either export it or associate it with another AWS supported service. You can also use the ACM console to request a new private certificate. Then, replace the old certificate for your AWS service, such as Elastic Load Balancing.

Check the renewal status

To check the renewal status, run the following describe-certificate command:

aws acm describe-certificate \--certificate-arn arn:aws:acm:REGION:111122223333:certificate/12345678-1234-1234-1234-123456789012

Note: Replace REGION with your AWS Region, 111122223333 with your account ID, and 12345678-1234-1234-1234-123456789012 with your certificate ID.

In the output, review the RenewalSummary field. If RenewalStatus is FAILED, then use the RenewalStatusReason value to identify the cause.

If the value is PCA_ACCESS_DENIED, then ACM doesn't have permissions on the private CA. If the value is PCA_INVALID_STATE, then the private CA isn't in an Active state. If the value is SLR_NOT_FOUND, then the ACM SLR is missing.

Resolve "PCA_ACCESS_DENIED"

The resolution depends on whether the private CA is in the same account or a different account.

The private CA is in the same account

Complete the following steps:

1. In the certificate account, grant the ACM service principal permissions to use the CA.

2. Run the following list-permissions command to confirm that the GetCertificate, IssueCertificate, and ListPermissions appear:

   aws acm-pca list-permissions \--certificate-authority-arn arn:aws:acm-pca:REGION:ACCOUNT_ID:certificate-authority/abcd1234-abcd-1234-abcd-12345678abcd

   Note: In the preceding command, replace REGION with your Region, ACCOUNT_ID with your account ID, and abcd1234-abcd-1234-abcd-12345678abcd with your CA ID.

The private CA is in a different account

You can't use the CreatePermission API for automatic renewals when both of the following conditions are true:

• The private CA and certificates are in different accounts.
• You shared the private CA through AWS Resource Access Manager (RAM).

Instead, the CA administrator must attach a resource-based policy that grants the ACM SLR in the consuming account permission to issue certificates. The consuming account uses the shared private CA). You can either use AWS RAM to share the private CA, or use the AWS CLI to manually attach a resource-based policy. The policy grants the ACM SLR permission to issue certificates in the consuming account.

When you use AWS RAM to share a private CA, AWS RAM automatically attaches the required resource-based policy to the CA.

To use AWS RAM, complete the following steps:

1. In the CA administrator's account, open the AWS RAM console.

2. Choose Create a resource share, and then select the private CA as the shared resource.

3. Add the certificate account ID or organizational unit as the principal.

4. In the certificate account, accept the resource share invitation.

   Note: If you activated resource sharing and you share the CA within an organization, then AWS Organizations automatically accepts the invitation.

To use the AWS CLI instead, first, create a JSON policy file with the following statement:

{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"AWS": "*"},"Action": ["acm-pca:IssueCertificate","acm-pca:GetCertificate"],"Resource": "arn:aws:acm-pca:REGION:111122223333:certificate-authority/abcd1234-abcd-1234-abcd-12345678abcd","Condition": {"StringLike": {"aws:PrincipalArn": "arn:aws:iam::444455556666:role/aws-service-role/acm.amazonaws.com/AWSServiceRoleForCertificateManager"}}}]}

Note: Replace REGION with your Region, 111122223333 with the account that owns the private CA, and abcd1234-abcd-1234-abcd-12345678abcd with your CA ID. Replace 444455556666 with the consuming account ID. The policy uses the StringLike condition to match the Amazon Resource Name (ARN) of the ACM SLR principal in the consuming account.

Then, run the following put-policy command from the CA administrator account to apply the policy:

aws acm-pca put-policy--resource-arn arn:aws:acm-pca:REGION:111122223333:certificate-authority/abcd1234-abcd-1234-abcd-12345678abcd--policy file://policy.json

Note: Replace REGION with your Region, 111122223333 with the CA administrator account ID, and abcd1234-abcd-1234-abcd-12345678abcd with the CA ID. Save the policy file as policy.json in your working directory.

Resolve "PCA_INVALID_STATE"

When the private CA isn't in the Active state, you receive the "InvalidStateException" error.

If the status is CREATING, then wait for creation to finish. Then, install the CA certificate. If the status is PENDING_CERTIFICATE, then install the CA certificate. If the status is EXPIRED, then install a new CA certificate. If the status is FAILED, then contact AWS Support.

If the status is DISABLED, then run the following update-certificate-authority command to update the CA to ACTIVE status:

aws acm-pca update-certificate-authority \--certificate-authority-arn arn:aws:acm-pca:REGION:111122223333:certificate-authority/abcd1234-abcd-1234-abcd-12345678abcd \--status ACTIVE

If the status is DELETED, then complete the following steps to restore the certificate within the 7 to 30 day restoration window:

1. Open the AWS Private Certificate Authority console.
2. On the Private certificate authorities page, select the deleted certificate.
3. Choose Actions, and then choose Restore.
4. Choose Restore again, and then wait for the restore to complete.
5. Choose Actions.
6. Choose Enable, and then choose Enable again to set the status to Active.

Resolve "SLR_NOT_FOUND"

To renew a certificate that's signed by a private CA in another account, ACM requires an SLR in the account where the certificate resides. If you deleted the SLR, then run the following create-service-linked-role command to recreate it:

aws iam create-service-linked-role --aws-service-name acm.amazonaws.com

Manually test managed renewal

After you resolve the renewal failure, confirm that the ACM service principal has the required IssueCertificate permission on the private CA. Then, manually test the configuration of you ACM managed renewal workflow.

Set up EventBridge rules for certificate renewal notifications

To receive notifications when a certificate ACM requires renewal action, configure automatic renewal events in Amazon EventBridge.

ACM publishes the following events:

• ACM Certificate Renewal Action Required
• ACM Certificate Approaching Expiration
• ACM Certificate Expired

To set up notifications, complete the following steps:

1. Open the EventBridge console.

2. Choose Create rule.

3. Under Get started, confirm that EventBridge Rule with event pattern is selected.

4. Enter a name and description for the rule.

5. Choose Next.

6. On the Build event pattern page, choose Advanced builder.

7. For Event pattern, enter the following pattern:

   {"source": ["aws.acm"],"detail-type": ["ACM Certificate Renewal Action Required"]}

8. Choose Next.

9. On the Select target(s) page, confirm that AWS service is selected.

10. Choose your preferred notification target , such as an Amazon Simple Notification Service (Amazon SNS) topic or AWS Lambda function.

11. Choose Next, and then review the rule details.

12. Choose Create rule.

Related information

Private certificate renewal in AWS Certificate Manager

Managed certificate renewal in AWS Certificate Manager

Handling exceptions

Create single-account permissions for an AWS Identity and Access Manager (IAM) user