Can't remove wildcard certificate

Question

I have a wildcard certificate, which is associated with 3 load balancers. The use case was to add it to custom domains for API Gateway, but I decided to delete them and the certificate. And although I tried to remove all custom domains, the certificate is still shown as in use. These load balancers' ARNs do not match any of the custom domains that I have. What could be done to delete this certificate?

Answer

Hi,

It may take some time once you've removed all the associations to reflect. Try it again as its been 2 days since you've posted the question.

Here are some useful documentations:
https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-delete.html - Delete using console and CLI
https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-describe.html- Find the association using ACM describe.

Also verify the region is correct.

Answer

When you associate an ACM certificate with an API Gateway, the service creates the backing resource (CF Distro or ALB, depending on your API GW deployment). Although you have deleted the API GW resource on your end, unfortunately the association hasn't been removed on the backing-resource end.

So, how do you fix this? Raise a case with AWS Premium Support, under the ACM service. If you're not currently paying for a support plan (Dev, Business, or Ent) then simply raise a case with Customer Support (covered by the free-tier support plan) and simply link them to this forum question. From there, they can reach out to the ACM support team and get the association removed for you.

Also, in case cost is a concern - ACM public certs are free of charge, so no cost is being incurred by you for having the cert remain in your account.

Can't remove wildcard certificate

Relevant content