Imported and ACM-issued certificates should be renewed after a specified time period

How to fix it

• Replaces the resource: Reimport keeps the key type and size, so a renewal with a different key is imported as a new certificate, attached everywhere this one is, and this one deleted.

In the console

Certificate Manager → Certificates → the certificate

Reimport certificate

For an imported certificate: the renewed Certificate body, Certificate private key and Certificate chain

Domains

For a DNS-validated ACM certificate: every CNAME record listed stays in public DNS (Create records in Route 53)

With the AWS CLI

aws acm import-certificate --certificate-arn <certificate-arn> --certificate fileb://certificate.pem --private-key fileb://private-key.pem --certificate-chain fileb://chain.pem --region <region>

With Terraform

resource "aws_acm_certificate" "this" {
  certificate_body  = file(var.certificate_path)
  private_key       = file(var.private_key_path)
  certificate_chain = file(var.certificate_chain_path)
}