Profile Applicability:

  • Level 1


Description:

This control ensures that all AWS Certificate Manager (ACM) certificates — whether issued by AWS or imported — are actively monitored for expiration within a specific number of days (e.g., 30 days or less). Certificates nearing expiration can cause service interruptions, broken HTTPS connections, and compliance violations. Establishing alerts before expiry helps ensure timely renewal or replacement.


Rationale:

Monitoring certificate expiration dates is essential to maintaining secure, uninterrupted encrypted connections (HTTPS, TLS). Expired certificates can lead to:

  • Application downtime and broken integrations.

  • Customer trust issues due to SSL/TLS validation errors.

  • Non-compliance with security frameworks (CIS, SOC 2, ISO 27001, PCI-DSS).

Implementing monitoring and alerts for certificates nearing expiration helps ensure proactive management and uninterrupted service availability.


Impact:

  • Positive Impact:Prevents accidental certificate expiration and downtime.Improves compliance and operational continuity.Ensures encrypted communications remain secure and trusted.
  • Negative Impact:Minimal administrative effort to review and renew certificates before expiry.


Default Value:

By default, AWS ACM automatically renews ACM-managed certificates (issued by Amazon) 60 days before expiry if domain validation remains valid.
However, imported certificates must be manually renewed before expiration — ACM does not auto-renew these.


Pre-Requisite:

  • IAM permissions required:

    • acm:ListCertificates

    • acm:DescribeCertificate

  • AWS CLI installed or access to AWS Management Console.

  • Optional: Amazon SNS topic or AWS Lambda function for automated alerts.


Remediation

Test Plan

Using AWS Console:

  1. Sign in to the AWS Management Console.

  2. Navigate to Certificate Manager (ACM).

  3. Review the Expiration date column.

  4. Identify certificates expiring in the next N days (e.g., 30 days or less).

  5. For ACM-managed certificates, confirm that automatic renewal is active.

  6. For imported certificates, verify that renewal is planned before expiry.


Implementation Plan

Using AWS Console:

  1. Navigate to ACM → Certificates.

  2. Sort or filter the list by Expiration date.

  3. Identify certificates expiring within the next 30 days.

  4. For certificates issued by ACM:

    • Confirm domain validation records (CNAME or DNS validation) are still valid for auto-renewal.

  5. For imported certificates:

    • Re-import a renewed certificate or request a new one before expiration.

  6. Optionally, configure a CloudWatch metric filter or Lambda script to monitor certificate expiration and send alerts via SNS or email.


Backout Plan

Using AWS Console:

  • If a certificate is mistakenly replaced or renewed, revert to the previous version by restoring the old certificate (if still valid) using ACM → Import certificate.



References: