对于现有的 AWS ACM 证书，我可以从 Email 验证切换到 DNS 验证吗？

Question

I've to Auto Renew expiring ACM certs and I'm not able to achieve that using the AWS PowerShell "Invoke-ACMCertificateRenewal" without manually clicking "I Approve" on the Validation Email.

I want to move to DNS Validation as this supports Auto-Renewal. But, the AWS document- https://aws.amazon.com/blogs/security/easier-certificate-validation-using-dns-with-aws-certificate-manager/ covers only for New Certificates. Is it possible to switch from Email Validation to DNS Validation for EXISTING ACM Certificates ?

Answer 1

According to the official AWS Certificate Manager FAQ , is is not possible to switch, you would have to create a new request:

Q. Can I convert an existing public certificate from email validation to DNS validation?

No, but you can request a new, free certificate from ACM and choose DNS validation for the new one.

You can go in ACM and simply request a new certificate for the same host using DNS Validation. Once certificate is issued you need to visit all your services tied to the old certificate and update to use the new one (for example an ELB or CloudFront)