How do I add a new SAN to an existing ACM certificate?

Short description

You can't modify an ACM certificate after you submit the request. To add a new SAN, request a new ACM certificate that includes the additional domain names.

Resolution

Request a new ACM certificate that includes all the domain names you require. You can use an asterisk (*) in the domain name to create a wildcard certificate. For example, *.example.com protects www.example.com and images.example.com.

Note: A wildcard certificate such as *.example.com covers subdomains only and doesn't automatically include the example.com apex domain. If your certificate must cover both subdomains and the apex domain, then add the apex domain as an additional SAN entry on the same certificate request, or request a separate certificate for the apex domain.

After the new certificate changes to Issued, associate the certificate with the resources that use the previous certificate. Then, view the ACM certificate details to identify the resources that use the previous certificate.

Replace the previous certificate on your resources. Take one of the following actions based on your resource type:

• Update an HTTPS listener for your Application Load Balancer.
• Replace the SSL certificate for your Classic Load Balancer.
• Update the TLS listener for your Network Load Balancer.
• Rotate the SSL/TLS certificates.
  Important: Amazon CloudFront requires the certificate to cover every alternate domain name that you associate with the distribution.

Related information

ACM certificate characteristics