Check ID: directoryservice_ldap_certificate_expiration
Provider: AWS
Service: directoryservice
Severity: MEDIUM
Categories: encryption
Resource type: Other

​
What this check verifies

AWS Directory Service Secure LDAP (LDAPS) certificates are assessed for upcoming expiration by comparing each directory’s certificate expiration to the current time and identifying those with <= 90 days remaining.

​
Risk

Expired LDAPS certificates cause TLS handshakes to fail, blocking directory binds and queries and disrupting authentication and app integrations (availability). If clients fall back to plain LDAP, credentials and directory data can be intercepted or altered (confidentiality and integrity).

​
Recommendation

Adopt certificate lifecycle management: inventory LDAPS certificates, alert well before expiry, and automate renewal with staged rollout and overlap. Enforce TLS-only LDAP and disable plaintext fallback. Apply least privilege and separation of duties to certificate issuance and deployment.

​
Remediation

aws ds register-certificate —directory-id <DIRECTORY_ID> —certificate-data file://certificate.pem

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = directoryservice_ldap_certificate_expiration. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks