Loading story…
AWS said AWS Certificate Manager (ACM) will phase out email validation for public certificates in 2027 and is directing customers to move to DNS validation. The change follows a CA/Browser Forum decision to end email-based domain validation for publicly trusted certificates by March 15, 2028. Under AWS's timeline, email validation will no longer be offered in new AWS Regions starting January 1, 2027, and ACM will stop accepting new requests for email-validated public certificates in all Regions on March 31, 2027.
AWS will stop renewing existing email-validated public certificates on September 30, 2027, making migration necessary for affected customers. To reduce disruption, AWS is updating the UpdateCertificateOptions API so organizations can switch certificates from email to DNS validation in place without changing the certificate ARN or dependent resources; after the change, customers must add an ACM-provided CNAME record within 72 hours to complete validation and enable automatic renewal. AWS said HTTP validation will remain available only for certificates used with Amazon CloudFront, while recommending DNS validation for most deployments.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
The CA/Browser Forum voted in November 2025 to end support for email-based domain validation for publicly trusted certificates, prompting industry migration to other validation methods.
From March 15, 2028, public certificate authorities will no longer be allowed to use email-based domain validation to issue or renew publicly trusted certificates, though certificates issued before that date remain valid until expiration.
AWS said ACM will stop renewing existing email-validated public certificates, requiring customers to complete migration to DNS validation before this point to avoid renewal interruption.
AWS said ACM will stop allowing new certificate requests that use email validation in any AWS Region.
AWS said ACM will stop offering email validation for public certificates in new AWS Regions as the first phase of its deprecation plan.
AWS announced that AWS Certificate Manager will discontinue support for email-validated public certificates and directed customers to migrate to DNS validation. AWS also said it is updating the UpdateCertificateOptions API to support in-place migration without changing certificate ARNs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourceaws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cloudflare has applied to the root programs operated by Google Chrome, Apple, Microsoft, and Mozilla to become a publicly trusted certificate authority (CA) capable of issuing TLS/X.509 certificates directly to customers. The company is also pursuing acquisition of an already trusted GlobalSign root certificate, reportedly **GlobalSign Root R5**, to enable certificate issuance before its own root is broadly embedded in client trust stores. Cloudflare plans to require certificate customers to use **ACME** automation and the ACME Renewal Information (**ARI**) extension, supporting automated certificate renewal, revocation, and reissuance. It also intends to begin experimental issuance of post-quantum Merkle-Tree Certificates (**MTCs**) alongside conventional certificates in 2026, expanding its role from CDN and security provider to public Web PKI operator.
Oct 1, 2026
AWS said **Shield Advanced** is shifting its application-layer automatic mitigation into the **AWS WAF Anti-DDoS managed rule group**, starting with automatic additions in **Count** mode for eligible web ACLs between July 27 and August 7, 2026. The new AWS WAF-based protection is designed to improve Layer 7 DDoS response with faster profiling and mitigation, support for **Block**, **Count**, and **Challenge** actions, lower web ACL capacity use from **150 WCU to 50 WCU**, and richer visibility through dashboards, labels, and CloudWatch and AWS WAF metrics. AWS said existing Shield Advanced automatic mitigation will remain active during the transition, but the legacy application-layer feature will be **retired on January 1, 2027**. Customers that do not migrate by then will lose automatic Layer 7 DDoS protection, while eligible configurations may be auto-upgraded beginning October 1, 2026 and receive temporary fee and WCU waivers during the evaluation period through September 30, 2026. AWS also warned customers using **infrastructure-as-code** and **AWS Firewall Manager** to update policies and definitions so application-layer protections continue after the migration.
Jul 28, 2026
Security researchers highlighted how attackers can obtain valid TLS certificates through domain-validation bypasses without compromising the target server, citing the 2023 **jabber.ru** incident in which fraudulent Let's Encrypt certificates were reportedly used to support man-in-the-middle interception of XMPP traffic. The attack was described as long-running, affecting multiple jabber.ru servers hosted in Germany, and demonstrated how control over DNS responses or network paths can enable trusted certificate issuance that appears legitimate to clients. Guidance from Let's Encrypt and independent researchers points to **CAA `accounturi`** restrictions as a stronger control by binding certificate issuance to a specific ACME account URL, alongside DNSSEC and restrictive CAA policy. Let's Encrypt documents that account IDs are exposed as ACME account URLs and can be retrieved by clients such as Certbot, enabling operators to configure these bindings and report issues accurately. Researchers also urged organizations to monitor Certificate Transparency logs, compare logged certificates with locally deployed certificates, and use external certificate and TLS-fingerprinting checks to detect unauthorized issuance and possible MITM activity earlier.
Jul 29, 2026