Letting ACM handle certificate renewal removed the one manual task that always got forgotten
A manually renewed TLS certificate expired unnoticed once, taking down a service for an embarrassing stretch of a morning, and moving fully to ACM managed certificates made sure that specific failure could never happen again.
A certificate for an internal service expired on a Tuesday morning because the calendar reminder to renew it manually had been silently ignored for months after the person who set it up left the team.
Moving to ACM
ACM certificates issued for services behind a load balancer or CloudFront renew automatically as long as the DNS validation record stays in place, which removes the human dependent step entirely instead of just making the reminder more reliable.
The migration itself
Migrating existing certificates meant requesting new ACM certificates for each domain, adding the DNS validation records, and once validated, swapping the load balancer listener to use the new certificate, a process that took an afternoon across our handful of internal services.
What actually changed
The real change was not technical so much as organizational, there is no longer a calendar reminder that depends on a specific person remembering to act on it, since renewal now happens automatically as long as the DNS record it depends on stays in place. The one thing worth double checking periodically is that nobody accidentally removes that validation CNAME record during an unrelated DNS cleanup, since that is the one way this automation can quietly break.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article