ACM certificate expires beyond the configured threshold

​

What this check verifies

ACM certificates are assessed for time to expiration against a configurable threshold. Certificates close to end of validity or already expired are surfaced, covering those attached to services and, if in scope, unused ones.

​

Risk

Expired or near-expiry TLS certificates can break handshakes, causing service outages and failed API calls (availability). Emergency fixes raise misconfiguration risk, enabling disabled verification or weak ciphers, which allows MITM and data exposure (confidentiality/integrity).

​

Recommendation

Adopt automated certificate lifecycle management: prefer ACM-issued certs with auto-renewal, or integrate imports with an automated renewal/rotation pipeline. Track expirations with alerts, enforce least privilege for cert operations, remove unused certs, and test rollovers to avoid downtime.

​

Remediation

Dashboard steps

1. In the AWS Console, open Certificate Manager (ACM)
2. If the expiring certificate is ACM-issued: select it and complete/restore validation (Create records in Route 53 or add the shown CNAME) so renewal can proceed
3. If the expiring certificate is imported: click Import a certificate, upload the new certificate and private key, then save
4. Update the service to use the new/renewed certificate:
   • ALB/NLB: EC2 > Load Balancers > Listeners > Edit > Change certificate to the new ACM certificate
   • CloudFront: Distributions > Edit > Viewer certificate > Select the new ACM certificate
   • API Gateway: Custom domain names > Edit > Choose the new ACM certificate
5. Verify the old certificate is no longer in use; delete it if not needed

​

References

• https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/ACM/certificate-expires-in-45-days.html
• https://repost.aws/es/knowledge-center/acm-notification-certificate-renewal
• https://docs.aws.amazon.com/config/latest/developerguide/acm-certificate-expiration-check.html
• https://repost.aws/questions/QU3sMaeZPMRo2kLcsfJsfuVA/acm-notifications-for-expiring-certificates

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = acm_certificates_expiration_check. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks