Ensure that your SSL/TLS certificates managed by AWS ACM are renewed 45 days before their validity period ends. Certificate Manager is the AWS service that lets you easily provision, manage, and deploy SSL/TLS certificates for use with other AWS resources such as Elastic Load Balancers, CloudFront distributions or APIs on Amazon API Gateway.
This rule can help you with the following compliance standards:
This rule can help you work with the AWS Well-Architected Framework
This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS
When Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates are not renewed prior to their expiration date, they become invalid and the communication between the client and the AWS resource that implements the certificates (e.g. Cloudfront distribution) is no longer secure.
Note: AWS Certificate Manager automatically renews certificates issued by the service that are used with other AWS resources. However, the ACM service does not renew automatically certificates that are not in use (i.e. not associated anymore with other AWS resources) so the renewal process must be done manually before these certificates become invalid. This conformity rules explains how to implement manually the renewal process 45 days before expiration.
To determine if there are any AWS ACM certificates that are expiring in 45 days, available in you AWS account, perform the following:
To renew any SSL/TLS certificates that are about to expire using AWS Certificate Manager service, perform the following:Note: The renewal process outlined below can be implemented only for imported SSL/TLS certificate currently managed by AWS ACM service.