ACM's email validation has a hard stop: September 30, 2027

AWS Certificate Manager will discontinue support for email-validated public certificates by September 30, 2027, and teams still using that method have to move to DNS validation before then ^[1]. The forcing function is external: in November 2025 the CA/Browser Forum voted to end email-based domain validation effective March 15, 2028, after which certificates validated by email will not be trusted by browsers no matter which certificate authority issued them ^[2][3].

The ACM ladder has four rungs. January 1, 2027: no email validation in new AWS Regions ^[4]. March 31, 2027: no email validation for new certificate requests in any Region ^[5]. September 30, 2027: ACM stops renewing existing email-validated certificates in any Region ^[6]. March 15, 2028: the Forum's date, after which public CAs cannot use email validation to issue or renew publicly trusted certificates, though certificates issued before it stay valid until they expire ^[7].

AWS describes its schedule as giving customers a full year to migrate ahead of the Forum's deadline ^[8]. That year is measured from the point where you can no longer request an email-validated certificate, March 31, 2027, which is about 11.5 months before March 15, 2028 ^[11]. The date that actually breaks production is the renewal cutoff, and September 30, 2027 sits roughly 5.5 months ahead of the industry deadline ^[10]. If you plan against the Forum's date rather than ACM's, you will be short by about five months.

The mechanics are undramatic, which is the point. ACM is updating the UpdateCertificateOptions API so a certificate can be switched from email to DNS validation in place: the ARN does not change, and resources that reference the certificate need no edits ^[9]. On update, ACM issues a CNAME record and gives you 72 hours to publish it; during that window the certificate keeps working on email validation, and if the window lapses the certificate simply stays on email validation so you can retry ^[12]. Once DNS validation completes, ACM is designed to renew automatically without further manual work ^[13]. Route 53 users get a one-click record creation option; everyone else downloads a CSV of CNAME records to import at their DNS provider ^[14].

The real cost is inventory. Certificates get requested once by someone who has since changed teams, and the validation email went to an address that may no longer be monitored. ACM's console filters, validation method set to Email and type set to Amazon Issued, will list the public email-validated certificates in an account, and the same query is available through the CLI ^[15]. Run it per account and per Region now, while there are two years of margin, rather than in the quarter when renewals stop.