Reading ACM certificate renewal notices

A certificate issued by ACM renews itself before it expires, as long as the CNAME record for DNS validation is still in place and the certificate is attached to an AWS resource. What lands in the mailbox then is a renewal confirmation like “Your certificate is renewed”, and there is nothing to do.

When the CNAME record has gone, when the certificate uses email validation, or when it is attached to no resource at all, the automatic renewal cannot happen and a mail marked “Action required” asks you to validate. That one needs action: miss the date and the certificate expires. If the expiry date gets close and the renewal still has not gone through, a warning about the coming expiry follows.

As a rule of thumb: “Action required”, “requires validation” or “expire” in the subject means something has to be done; “renewed” or “has been issued” means it is there to be read. The body carries the domain name and the certificate's ARN — which contains the account ID — so it tells you which customer and which site it is about.

The hard case is the week when certificates for several customers' domains renew at once and a dozen mails with the same subject line arrive together. One “Action required” among them is easy to miss.

Sabaki pulls the account ID out of the ARN in the body, files the notification under that customer, and marks a renewal confirmation “Info” and a validation request “Action required”, with the date it is due. Even in a row of identically titled notifications, the summary tells them apart at a glance: “nothing needs doing” versus “add the DNS record by such-and-such a date”. Unlike marketing mail, these are delivered to Slack and email as well.

There are only a few reasons an automatic renewal fails. Read the explanation, work out which one applies, and if the work falls on the customer's side, the summary goes straight into the message you send them.

• The CNAME record for DNS validation is gone, lost in a domain transfer or a rebuilt zone.
• The certificate uses email validation, and nobody answered the approval mail sent to admin@ or webmaster@.
• The certificate is attached to no AWS resource at all, which puts it outside automatic renewal (if nothing needs it, delete it).

Renewal confirmations can be searched by subject in the inbox, selected all at once and archived together. Leaving only the one that needs action and following it in the ledger keeps the whole round short.