AWS Certificate Manager to discontinue email validation, adds DNS switch

AWS Certificate Manager announced it will end support for email-validated public certificates by September 30, 2027, aligning with the CA/Browser Forum's industry-wide deprecation of email-based domain validation. Customers relying on email validation must migrate to DNS validation before that date or risk certificates that can no longer be renewed.

To ease the migration, AWS shipped a complementary capability the same day: ACM now supports changing the domain validation method on existing public certificates from email to DNS without reissuing the certificate or changing its ARN. That matters operationally because reissuance historically meant new ARNs and downstream reconfiguration across load balancers, CloudFront distributions and other integrations — friction that discouraged proactive migration.

While not an AI story, it is a substantive infrastructure change for the large base of teams that automate certificate lifecycles on AWS, and it reflects a broader security-hygiene trend: the CA/B Forum has been steadily tightening domain-validation methods because email validation is more susceptible to interception and misissuance. The practical guidance for engineering teams is to inventory email-validated certs now and use the new in-place switch to move to DNS validation well ahead of the 2027 cutoff, since DNS validation also enables automated renewal that email validation cannot.