All checks
Medium
Expired SSL/TLS certificates managed in IAM should be removed
Checks that no SSL/TLS server certificate stored in IAM has expired. An expired certificate left in IAM can still be deployed to a resource by mistake, which breaks HTTPS there. An account that has never stored a certificate in IAM also passes, and the evidence line says so.
- service
- IAM
- severity
- Medium
- scope
- evaluated once per account
How to fix it
- Interrupts service: Take the certificate off any load balancer listener first: AWS warns Elastic Load Balancing may keep using a deleted certificate and stop accepting traffic.
Settings
- ServerCertificateName
- Each certificate whose Expiration has passed, as list-server-certificates shows it
With the AWS CLI
aws iam delete-server-certificate --server-certificate-name <server-certificate-name>See which of your accounts this check is failing on.
Book a live scan