Back to Checks
aws

ACM certificate expires in more than the configured threshold of days

acm_certificates_expiration_check
Service: acmSeverity: high
OfficialBuilt-inVerified
Resource Type:AwsCertificateManagerCertificate

ACM certificates are assessed for time to expiration against a configurable threshold. Certificates close to end of validity or already expired are surfaced, covering those attached to services and, if in scope, unused ones.

Prowler logoProwlerprowler-provider-aws

Risk

Expired or near-expiry TLS certificates can break handshakes, causing service outages and failed API calls (availability). Emergency fixes raise misconfiguration risk, enabling disabled verification or weak ciphers, which allows MITM and data exposure (confidentiality/integrity).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks acm_certificates_expiration_check

Recommendation

Adopt automated certificate lifecycle management: prefer ACM-issued certs with auto-renewal, or integrate imports with an automated renewal/rotation pipeline. Track expirations with alerts, enforce least privilege for cert operations, remove unused certs, and test rollovers to avoid downtime.

Remediation

Other

1In the AWS Console, open Certificate Manager (ACM)
2If the expiring certificate is ACM-issued: select it and complete/restore validation (Create records in Route 53 or add the shown CNAME) so renewal can proceed
3If the expiring certificate is imported: click Import a certificate, upload the new certificate and private key, then save
4Update the service to use the new/renewed certificate:
5- ALB/NLB: EC2 > Load Balancers > Listeners > Edit > Change certificate to the new ACM certificate
6- CloudFront: Distributions > Edit > Viewer certificate > Select the new ACM certificate
7- API Gateway: Custom domain names > Edit > Choose the new ACM certificate
8Verify the old certificate is no longer in use; delete it if not needed

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS, Severity
from prowler.providers.aws.services.acm.acm_client import acm_client


class acm_certificates_expiration_check(Check):
    def execute(self):
        findings = []
        for certificate in acm_client.certificates.values():
            if certificate.in_use or acm_client.provider.scan_unused_services:
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=certificate
                )
                if certificate.expiration_days > acm_client.audit_config.get(
                    "days_to_expire_threshold", 7
                ):
                    report.status = "PASS"
                    report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} expires in {certificate.expiration_days} days."
                else:
                    report.status = "FAIL"
                    if certificate.expiration_days < 0:
                        report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} has expired ({abs(certificate.expiration_days)} days ago)."
                        report.check_metadata.Severity = Severity.high
                    else:
                        report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} is about to expire in {certificate.expiration_days} days."
                        report.check_metadata.Severity = Severity.medium
                findings.append(report)
        return findings

References