Redshift Serverless SSL certificate expired and not being rotated — us-east-1

Question

I have a Redshift Serverless workgroup in us-east-1 whose Amazon-managed SSL certificate has expired and does not appear to have been automatically rotated.

**Certificate Details:**
Subject: CN=***.us-east-1.redshift-serverless.amazonaws.com
Issuer: CN=Amazon RSA 2048 M03, O=Amazon, C=US
Valid From: July 2, 2025
Valid Until: August 1, 2026 (expired 25 days ago)
Region: us-east-1

**Symptoms:**

AWS Glue ETL jobs connecting to the workgroup began failing on August 1, 2026
Error: SSL error: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed
Jobs that ran successfully prior to August 1 now consistently fail at the Redshift sink step

What I've tried:
Confirmed SSL is enabled on the JDBC connection
Cannot rotate or replace the certificate as it is Amazon-managed

**Questions:**
Is automatic certificate rotation expected for Redshift Serverless endpoints, and is there a known delay or issue with rotation in us-east-1?
Is there a way to manually trigger certificate renewal on a Serverless workgroup without a paid support plan?
Are other users in us-east-1 seeing the same issue?

Ajit N K · Answer

This is a known gap in how ACM renewal works for Redshift Serverless. The docs confirm that Redshift Serverless creates and installs an ACM-issued certificate for each workgroup automatically — but ACM only auto-renews certificates that are associated with a specific set of integrated AWS services (ELB, CloudFront, API Gateway, EKS, Cognito, App Runner, etc.). Redshift Serverless is not on that list, which means the certificate was issued by ACM but fell outside the auto-renewal boundary. It expired on August 1 with no automatic rotation, and nothing in the default setup would have warned you before it happened.

The immediate fix is on AWS Support to reissue — you cannot rotate that cert yourself, so keep the case open and escalate to P1 if the pipeline has been blocked 25+ days.

For the durable fix so this never silently kills production again: ACM emits a DaysToExpiry CloudWatch metric once per day for every certificate, including ones managed by Redshift Serverless. A single CloudWatch alarm on that metric with a 30-day threshold routed to SNS gives you a loud warning well before the next expiry. Takes about 15 minutes to set up and is free. Pair that with an EventBridge rule for ACM expiry events from Personal Health Dashboard as a secondary catch.

If you also want to harden the Glue side so a future cert blip does not hard-fail the entire pipeline, Glue job retry config with exponential backoff and a dead-letter S3 bucket for failed writes will isolate the failure rather than block all downstream data.

Happy to share the exact CloudWatch alarm config or  retry pattern if useful

Kauê Fernandes Braz · Answer

Hi,
Just to confirm on your first question: automatic certificate rotation is expected behavior for Redshift Serverless, the managed cert is issued via ACM and should renew transparently without any action needed on your side, so what you're seeing looks like a rotation that failed on AWS's side rather than a config issue in your account.

Since it's an Amazon-managed cert, there isn't a self-service way to force renewal from the console/CLI. Your best bet is opening a support case with AWS, even on Basic/Developer plans you can file a general/account case

Redshift Serverless SSL certificate expired and not being rotated — us-east-1

Add your answer

Relevant content