🛡️ AWS ACM Certificate validation has failed🟢

• Contextual name: 🛡️ Certificate validation has failed🟢
• ID: /ce/ca/aws/acm/certificate-validity
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS ACM Certificate
  • 🔌 AWS ACM Certificate - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: AWS ACM Certificates Validity

Description

Open File

Description

This policy identifies AWS ACM Certificates that have failed the validation process.

All requests made during the SSL/TLS certificate issuance or renewal process must be successfully validated. These requests are managed within your AWS account by Amazon Certificate Manager, a service that enables you to provision, deploy, and manage SSL/TLS certificates for use with AWS resources such as Elastic Load Balancers, Amazon CloudFront distributions, and APIs hosted on Amazon API Gateway.

Rationale

ACM certificates must be validated using DNS or email-based validation to confirm domain ownership before they can be issued.

If an ACM certificate is not validated within the required timeframe (typically 72 hours from the time the request is created), the validation attempt fails and the certificate request becomes invalid. In such cases, a new SSL/TLS certificate must be requested, which may result in service disruptions or application downtime.

Audit

This policy marks an AWS ACM Certificate as INCOMPLIANT if the Status field is set to FAILED or VALIDATION_TIMED_OUT.

... see more

Remediation

Open File

Remediation

Re-initiate ACM Certificate Validation (Email Validation)

For Amazon Certificate Manager (ACM) certificates that have failed or timed out during email-based validation, re-initiate the validation process by resending the domain validation email using the AWS CLI.

Note

The steps below apply only to certificates that use email validation. Certificates that use DNS validation cannot use the email resend operation and require updates to the domain’s DNS configuration instead.

A common reason for DNS-based validation failure is that the required DNS CNAME record generated by ACM was not created or was created incorrectly. To remediate this issue, review the DNS validation (CNAME) instructions provided by ACM and request a new certificate, ensuring the DNS records are correctly configured before validation.

From AWS CLI

1. Resend the domain validation email for the affected ACM certificate by running the following command. Replace the placeholders with values specific to your environment:

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 AWS Well-Architected → 💼 SEC09-BP01 Implement secure key and certificate management			5		no data
💼 Cloudaware Framework → 💼 Cryptographic Configuration			9		no data