AWS History and Timeline regarding AWS Certificate Manager - Overview, Domain Validation Methods, Features, Summary of Updates, and Introduction to ACM

First Published: 2026-10-13
Last Updated: 2026-10-13

Those who have been using ACM certificates for a long time will find that numerous assumptions remain embedded in design documents, procedures, and existing AWS CloudFormation templates. These assumptions include verifying domain ownership via email, with validation emails also sent to the contacts listed in the domain's WHOIS information; the ability to disable logging to Certificate Transparency (CT) logs on a per-certificate basis; and the fact that ACM only issues certificates using RSA keys. However, some of these assumptions, as outlined in ACM documentation as of October 13, 2026, are already no longer valid. A single document alone cannot reveal which assumptions were valid, and for how long, throughout ACM's history.

ACM was first released on January 21, 2016. Initially, it only supported verifying domain ownership via email, allowing certificates to be attached to Elastic Load Balancing and Amazon CloudFront. On November 22, 2017, DNS validation was added. In 2018, logging to CT logs became the default. On November 8, 2022, ACM gained the ability to issue certificates using ECDSA. In 2024, the method of sending validation emails to WHOIS contacts was discontinued, and the console no longer supported email validation using MX records. On April 28, 2025, HTTP validation was added for certificates used with CloudFront. On June 1, 2026, the option to disable logging to CT logs was removed. From 2025 to 2026, a series of updates related to the ability to export public certificates, ACME support, and the planned end of email validation followed.

This article presents a timeline detailing the features that ACM has added and removed, along with the dates associated with each change as documented in various materials. The two key questions this timeline aims to answer are: first, when were the assumptions present in existing design documents and procedures added, and when were they removed? Second, which documents contain these dates, and which rows in the timeline have different dates across different documents?

Based on the explicitly stated information in the primary sources, the answers are as follows. First, the method for validating domain ownership changed in this order: email only (from 2016-01-21), email and DNS (from 2017-11-22), the period when email validation using WHOIS and MX was removed (2024), and the period when HTTP validation was added for certificates used with CloudFront (from 2025-04-28). Email validation itself is scheduled to end in 2027, as of 2026-10-13.

Next, for logging to CT logs, an API to stop logging came first (2018-03-27), logging then became the default (2018-04-24), and the option to stop logging was removed (2026-06-01). From 2018-04-24 to 2026-06-01, logging was the default, but it was still possible to disable it on a certificate-by-certificate basis.

Finally, the dates for the same events often differ across various sources, such as What's New, the Document history of the User Guide, and the AWS blogs. For example, the integration with Elastic Beanstalk is listed as 2016-05-23 in the What's New section, but as 2017-03-21 in the Document history. This article presents a table, "Where the Dates Differ," which lists these discrepancies by source.

Domain Validation Methods Added and Removed in ACM

This article focuses solely on the dates when ACM features were added and removed, as well as the sources of those dates. It does not address pricing. Detailed information about the features introduced between 2025 and 2026 is covered in three separate articles: How AWS Certificate Manager Issues Public Certificates, Moving AWS Certificate Manager Off Email Validation, and When Public Certificates Stop Carrying clientAuth. Therefore, this article keeps the rows for those features short and leaves the details to those articles.

Background and Method of Creating AWS Certificate Manager Historical Timeline

This section first outlines the sources used for the entries in the timeline and explains how the date and the Change value of each entry were determined. All sources were accessed on October 13, 2026.

The Primary Sources This Article Used, and What It Made into Entries

The rows in the timeline were compiled from the following sources:

What's New: As of October 13, 2026, there were 51 announcements tagged with whats-new#general-products#aws-certificate-manager. The oldest of these announcements dates back to January 21, 2016. Of these, 28 announcements have AWS Private CA (earlier names include ACM Private CA) as the subject of the title. Announcements lacking this tag were supplemented through a full-text search of What's New using the terms Certificate Manager and ACM. For this article, the publication date (postDateTime) from What's New was used as the date.

ACM User Guide – Document history: This section is divided into two tables. The first table (28 rows) follows the sentence The following table describes the documentation release history of AWS Certificate Manager beginning in 2018. and has a column labeled Date. The second table (18 rows) covers releases prior to 2018 and has a column labeled Release Date. The date for each row is located at the end of that row.

AWS News Blog and AWS Security Blog: This article used the posts about the launch of ACM, DNS validation, Certificate Transparency (CT) logs, ACM Private CA, the end of WHOIS, the end of Starfield Class 2 cross-signing, and the end of email validation.

ACM User Guide pages and API Reference: These were used to check the state of ACM as of the verification date.

The changes documented include methods for verifying domain ownership, logging to Certificate Transparency (CT) logs, AWS services (integrated services) that support ACM certificates, certificate import, key algorithms, monitoring (using Amazon CloudWatch metrics and events), IAM condition keys, the expansion of supported Regions, and events related to changes in certificate chains. Changes that only involved modifying the wording of the documentation (such as the addition of IAM details on 2017-04-28 or the relocation of the monitoring section on 2021-03-23) were not included. Of the announcements whose sole subject is AWS Private CA, only two were documented: the initial release as an ACM feature on 2018-04-04, and the ability to use another account's AWS Private CA through ACM on 2020-08-17. Announcements regarding compliance updates and pricing changes were also excluded. Based on these criteria, 49 items were selected. In other words, please note that the items on this timeline are not all updates to AWS Certificate Manager, but are representative updates that I have picked out.

Timeline Columns, Change Values, and Date Sources

The timeline consists of tables with five columns:

Date — Represents the date associated with the row. The method for determining this date is described in the following paragraph. Rows whose source gives only the month are written as YYYY-MM.
Change — Indicates the type of change. The value will be one of seven options listed below.
What Happened — Describes the event or change. The original text from the source material is presented in English.
Date Source — Specifies the type of document from which the 'Date' value was obtained. The value will be one of six options listed below.
Source — Refers to the specific document used as the basis for the row. This column may include documents beyond those used for the 'Date Source'.

The 'Date' value is the posting date of the What's New announcement if there is one, and otherwise the date of the Document history entry. If neither of these is available, the publication date of the blog post is used. This order of precedence mirrors that outlined in Section 6.2 of Where the AWS Primary Sources Disagree About Launch Dates. However, for rows where a feature was removed and for scheduled rows, the 'Date' is the date written in the body of the source if the body gives one. This is because the day of an announcement and the day a feature was actually removed are different days.

The 'Change' values are as follows:

Added — A feature, integration, Region, or API was added.
Changed — Default values or behavior were modified.
Renamed — The name was changed. (Not used in this article.)
Deprecated — A source stated that a feature is deprecated or that it will end in the future. The feature could still be used at that point.
Removed — A source stated, with words such as no longer supports or no longer available, that a feature was removed.
Ended — Support or availability for the feature ended. (Not used in this article.)
Scheduled — A planned date that had not yet arrived on the verification date (2026-10-13).

There are instances where the terminology used in the source documents does not align with the 'Change' values used in this article. For example, on 2024-07-11, the MX entry in the 'Document history' uses the heading Deprecation, but the body of the document states no longer supports. Therefore, this article classifies it as "Removed." Similarly, on 2026-06-01, the CT entry uses the heading deprecated, but the body of the document indicates that the option to stop recording is no longer available, so this article classifies it as "Removed." Both of these entries include both the terminology from the source document and the classification used in this article within the 'What Happened' column.

The values for "Date Source" are as follows:

What's New: The posting date (postDateTime) of a What's New announcement. For the scheduled row, however, the Date is a date written in the body of the announcement, and What Happened says so.
Document history: The date of entries in the "Document history" section of the ACM User Guide.
AWS News Blog and AWS Security Blog: The publication date of the articles. However, for rows whose Date is a date written in the body of a post, What Happened says so. This article does not use the AWS News Blog as a Date Source.
User Guide: A date written in the body of the ACM User Guide.
API Reference: A date written in the body of the ACM API Reference. This article does not use it as a Date Source.

Dates from the timelines of other articles are not used as a Date Source. Where another timeline gives a different date, that date appears only in the table titled "Where the Dates Differ."

Conflicting Dates and Statements for the Same Events

It is common for different sources to list different dates for the same event. This article does not claim that any of these dates are incorrect. This article places a single date in the main timeline, and the dates in other sources appear, source by source, in the "Where the Dates Differ" table. This table categorizes date discrepancies into four categories:

Different kinds of dates — This refers to instances where sources record different types of dates, such as the announcement date, the date a document was updated, the date a feature was discontinued, or the publication date of a blog post.
Same date, different statements — In these cases, the dates are the same, but the information or names associated with those dates differ between sources.
The sources disagree — This category covers instances where sources give different dates of the same kind for the same event.
Statement not found — For one of the dates, this article has not found a source that states it. Not finding a statement does not prove that no such statement exists.

This categorization is based on Sections 3 and 4 of Where the AWS Primary Sources Disagree About Launch Dates.

Topics Covered in Other Articles

Other articles on this site cover the following topics as their main subjects. This article gives them only timeline rows and short descriptions.

How to Obtain Public Certificates from ACM (2025–2026) (Exportable public certificates, ACME, where the private key is stored, renewal, and what gets recorded) — How AWS Certificate Manager Issues Public Certificates
Schedule for Ending Email Validation and Switching to DNS — Moving AWS Certificate Manager Off Email Validation
When Public Certificates No Longer Include clientAuth — When Public Certificates Stop Carrying clientAuth
History and Timeline of Industry CT, ACME, and Shortened Certificate Validity Periods — TLS Certificate Ecosystem History and Timeline
Timeline and Design of AWS Private CA — AWS History and Timeline regarding AWS Private Certificate Authority and AWS Private CA Hierarchy Design
Steps to Obtain ACM Certificates Using DNS Validation on Personal Websites — Indie Dev Guide

AWS Certificate Manager Historical Timeline (Updates from January 21, 2016)

The following four tables present the core historical timeline. Following these tables is a "Where the Dates Differ" table, which lists events whose dates differ by source. Each table's columns are defined as described in the previous section. All references were obtained on October 13, 2026.

Index:

2016–2017 - The period when ACM was launched, integrated services were added, and certificate importing and DNS validation were introduced.
2018–2021 - The period when logging to Certificate Transparency (CT) became the default, ACM Private CA was launched, and certificate expiry monitoring was added.
2022–2024 - The period when ECDSA certificates and IAM condition keys were added, and validation methods using WHOIS and MX records for email were removed.
2025–2027 - The period when HTTP validation, exportable public certificates, and ACME were added, and the option to stop logging to Certificate Transparency (CT) was removed. This also includes the planned end of email validation (as of October 13, 2026).
Where the Dates Differ - Events whose dates differ by source.

* You can sort the table by clicking on the column name.

2016–2017 — The Launch of ACM, Integrated Services, Imported Certificates, and DNS Validation

During 2016–2017, ACM became available, expanding the range of services that allow certificate installation. Until November 22, 2017, the only method for verifying domain ownership was through email.

Date	Change	What Happened	Date Source	Source
2016-01-21	Added	ACM (AWS Certificate Manager) was released. The announcement stated: `AWS Certificate Manager is a new service that lets you easily provision, manage, and deploy Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services.` The AWS News Blog post from the same day stated that it was `available now in the US East (N. Virginia) region, with additional regions in the works`, and provided instructions for verifying ownership via email. The oldest entry in the Document history (`This release introduces AWS Certificate Manager.`) also reflects this date.	What's New	Introducing AWS Certificate Manager, New – AWS Certificate Manager – Deploy SSL/TLS-Based Apps on AWS, Now Available: AWS Certificate Manager, Document history
2016-01-21	Added	It became possible to associate ACM certificates with Amazon CloudFront distributions. The announcement stated: `You can now provision SSL/TLS certificates and associate them with CloudFront distributions within minutes.` It also noted: `Note that CloudFront still supports using certificates that you obtained from a third-party certificate authority and uploaded to the IAM certificate store.`	What's New	Amazon CloudFront Integrates with AWS Certificate Manager
2016-01-21	Added	You can now attach ACM certificates to Elastic Load Balancing load balancers. The announcement stated, `Integration with AWS Certificate Manager makes it simple to deploy a certificate to the load balancer.`	What's New	Elastic Load Balancing: Support for AWS Certificate Manager
2016-03-25	Added	AWS CloudTrail logging for ACM operations has been added to the Document history. The entry states, `Added AWS CloudTrail support for ACM actions.` This date reflects the update to the document.	Document history	Document history
2016-05-16	Added	ACM is now available in additional Regions. The announcement stated, `You can now provision SSL/TLS certificates from AWS Certificate Manager in nine additional Regions.`	What's New	AWS Certificate Manager now available in more regions
2016-05-23	Added	You can now select ACM certificates for your AWS Elastic Beanstalk applications. The announcement stated, `You can start choosing ACM certificates for your Elastic Beanstalk applications from the Elastic Beanstalk console or with the EB CLI, SDKs, and APIs.`	What's New	AWS Elastic Beanstalk Supports AWS Certificate Manager
2016-08-09	Added	AWS CloudFormation now allows you to create certificates using ACM. The announcement states, `You can now provision the following AWS resources using CloudFormation.` and lists AWS Certificate Manager, along with `Specify an AWS Certificate Manager certificate for a CloudFront distribution` for CloudFront distributions.	What's New	AWS CloudFormation Adds Support for AWS Certificate Manager, Amazon ECS Service Auto Scaling, and Additional Updates
2016-10-13	Added	A description of imported certificates has been added to the Document history. The entry reads, `Added documentation about Imported certificates.` This article did not find a What's New announcement or a blog post about imports (it searched What's New, `aws-knowledge`, and the web). This date reflects the update to the document itself.	Document history	Document history
2017-03-09	Added	You can now use ACM certificates with custom domains in Amazon API Gateway. The announcement states, `You can now configure custom domains for your APIs on Amazon API Gateway using SSL/TLS certificates provisioned and managed by AWS Certificate Manager (ACM).`	What's New	Amazon API Gateway Integrates with AWS Certificate Manager (ACM)
2017-06-01	Added	AWS Certificate Manager is now available in AWS GovCloud (US). The announcement was titled `Introducing AWS Certificate Manager` and states `AWS Certificate Manager is a new service in the AWS GovCloud (US) region`.	What's New	Introducing AWS Certificate Manager
2017-07-07	Added	The Document history was updated to include information about reimporting certificates and certificate pinning. The entries read, `Added information about reimporting a certificate to Reimport a certificate.` and `Added information about certificate pinning to Best practices and to Troubleshoot issues with AWS Certificate Manager.`	Document history	Document history
2017-09-21	Added	The Document history was updated to include information about CAA records. The entry read, `Added information about CAA records to (Optional) Configure a CAA record.`	Document history	Document history
2017-11-22	Added	A method for verifying domain ownership using DNS has been added. The announcement states, `Previously ACM supported only email validation, which required the domain owner to receive an email for each certificate request and validate the information in the request before approving it.` It also states, `With DNS validation, you simply write a CNAME record to your DNS configuration to establish ownership or control of your domain name.` The Document history entry is dated 2017-11-21.	What's New	AWS Certificate Manager: Easier Certificate Validation Using DNS, Easier Certificate Validation Using DNS with AWS Certificate Manager

2018–2021 — Certificate Transparency Logs, ACM Private CA, and Certificate Expiry Monitoring

During this period, logging to CT logs became the default. An API to stop logging was released prior to the default setting taking effect. ACM Private CA was introduced as an ACM feature.

Date	Change	What Happened	Date Source	Source
2018-03-27	Added	An API was released that allows you to disable logging to CT logs on a per-certificate basis. An article on the AWS Security Blog, published on 2018-04-05, states in its update notes: `On March 27, 2018, we updated ACM APIs so that you can disable Certificate Transparency logging on a per-certificate basis.` The Date is this date in the body of the article. A corresponding entry in the Document history states: `Added certificate transparency logging to Best Practices.`	AWS Security Blog	Preparing for AWS Certificate Manager (ACM) Support of Certificate Transparency, Document history
2018-04-04	Added	ACM Private CA was released as a feature of ACM. The announcement on What's New was titled `Introducing AWS Certificate Manager Private Certificate Authority`. The same day's AWS News Blog post stated, `Today we’re launching a new feature for AWS Certificate Manager (ACM), Private Certificate Authority (CA).` and used the name `ACM Private CA`. The same day's Document history entry used the heading `Launching AWS Private CA` (a name used from 2022 onwards) and the body read, `Launched ACM Private Certificate Manager (CM), and extension of AWS Certificate Manager that allows users to establish a secure managed infrastructure for issuing and revoking private digital certificates.` (as originally written). When the link to the What's New announcement was accessed on 2026-10-13, it redirected to `https://aws.amazon.com/about-aws/`, so the date was taken from the `postDateTime` within the What's New listing.	What's New	AWS Certificate Manager Launches Private Certificate Authority, Document history
2018-04-24	Changed	Recording to Certificate Transparency logs is now the default. The Document history entry says `Added ability to publish ACM public certificates into certificate transparency logs by default.` The AWS Security Blog article from 2018-04-05 states, `On April 24, 2018, we updated ACM to publish certificates to CT logs on issuance and on renewal, unless you disable Certificate Transparency logging.`	Document history	Document history, Preparing for AWS Certificate Manager (ACM) Support of Certificate Transparency
2019-03-18	Added	Customers can now manually test the configuration of their ACM managed renewal workflow. The What's New announcement states, `The renewal command is for developers who want to test the managed renewal and deployment of their ACM Private CA certificates and validate end-to-end operations.` The Document history entry of 2019-03-14 says `Customers can now manually test the configuration of their ACM managed renewal workflow.`	What's New	Announcing the renewal command for AWS Certificate Manager, Document history
2019-11-21	Added	You can now add tags to ACM certificates when they are created, and you can use these tags to define IAM policies. The announcement states: `Upon creation, you can tag your ACM certificates and private certificate authorities (CAs).` Additionally, it states: `In addition, you can now set IAM policies on your ACM Certificates and Private CAs using tags.`	What's New	Tag-on Create and Tag-Based IAM for AWS Certificate Manager and Private Certificate Authority
2019-12-19	Added	ACM's API now includes endpoints that have been validated according to FIPS 140-2. The announcement states: `AWS Certificate Manager (ACM) and ACM Private Certificate Authority (CA) now offers Federal Information Processing Standards (FIPS) 140-2 validated endpoints in US Regions to protect sensitive information.`	What's New	AWS Certificate Manager and Private Certificate Authority Support FIPS 140-2 Endpoints
2020-03-04	Added	ACM is now available in the AWS China (Beijing and Ningxia) Regions. The Document history states: `Added region support for the AWS China (Beijing and Ningxia) Regions.`	Document history	Document history
2020-06-16	Added	You can now use CloudFormation templates to complete DNS validation and issue certificates. You can also configure the templates to disable Certificate Transparency (CT) logging. The announcement states: `First, you can now use CloudFormation templates to perform all of the steps to validate your domain with DNS validation and issue your certificate.` and `Third, you can disable CT Logging if you do not want your certificates automatically logged in a public CT Log.`	What's New	AWS Certificate Manager Extends Automation of Certificate Issuance Via CloudFormation
2020-08-17	Added	It is now possible to issue private certificates in ACM using a Private CA from a different account. The announcement states: `AWS Certificate Manager (ACM) Private Certificate Authority (CA) now supports sharing a Private CA with any AWS account or within your organization.` The corresponding entry in the Document history says `Added cross-account support for using private CAs from AWS Private CA.` and uses the name in use since 2022.	What's New	AWS Certificate Manager Private Certificate Authority now supports Private CA sharing, Document history
2020-10-28	Added	Amazon EC2 instances using AWS Nitro Enclaves can now utilize ACM certificates. The announcement states: `ACM for Nitro Enclaves is an enclave application that allows you to use public and private SSL/TLS certificates with your web applications and servers running on Amazon EC2 instances with AWS Nitro Enclaves.`	What's New	Announcing SSL/TLS certificates for Amazon EC2 instances with AWS Certificate Manager (ACM) for Nitro Enclaves
2021-03-03	Added	The number of days until a certificate's expiration is now visible through the `DaysToExpiry` CloudWatch metric. The announcement states, `AWS Certificate Manager (ACM) now publishes certificate metrics and events through Amazon CloudWatch and Amazon EventBridge.` The corresponding entry in the Document history reads, `Added DaysToExpiry metric and event and supporting APIs.`	What's New	AWS Certificate Manager now provides certificate expiry monitoring through Amazon CloudWatch, Document history
2021-07-14	Added	You can now import and use ECDSA certificates, as well as RSA certificates with key lengths longer than 2048 bits, with integrated services. The announcement states, `You can use ACM to issue RSA 2048 certificates.` Additionally, it states, `ACM now allows you to import and use ECDSA P256, P384, P521 and RSA 3072, 4096 SSL/TLS certificates with integrated services.`	What's New	AWS Certificate Manager provides expanded usage of imported ECDSA and RSA Certificates, Document history

2022–2024 — ECDSA Certificates, IAM Condition Keys, and the End of WHOIS and MX Email Validation

During this period, ACM gained the capability to issue ECDSA certificates. In email validation, the method of sending emails to the WHOIS contacts was discontinued, and the console also stopped supporting the method that uses MX. The method of sending emails to five designated addresses remains in place.

Date	Change	What Happened	Date Source	Source
2022-03-16	Added	Hybrid post-quantum TLS is now available for connecting to AWS KMS and ACM API endpoints. The announcement stated, `Hybrid post-quantum TLS for connecting to AWS KMS and ACM is available in all public AWS Regions.` and `No changes to the types of certificates supported by ACM are being made at this time.` Information on post-quantum cryptography is available at Post-Quantum Cryptography Standardization Timeline and Migration on AWS.	What's New	AWS KMS and ACM now support the latest hybrid post-quantum TLS ciphers
2022-10-27	Added	Events were added that report when a certificate has expired, when it is available, and when its renewal needs action. The Document history entry states, `Added ACM Certificate Expired, ACM Certificate Available, and ACM Certificate Renewal Action Required events.`	Document history	Document history
2022-11-08	Added	ACM now supports the issuance of certificates using the Elliptic Curve Digital Signature Algorithm (ECDSA). The announcement states: `You can use either the ACM console or the request-certificate API with the key-algorithm parameter to issue public / private ECDSA P-256 and P-384 TLS certificates.` The corresponding entry in the Document history reads: `Added support for Elliptic Curve Digital Signature Algorithm (ECDSA) when requesting a public ACM certificate.`	What's New	AWS Certificate Manager now supports Elliptic Curve Digital Signature Algorithm TLS certificates, Document history
2023-08-23	Added	It is now possible to restrict certificate requests using IAM condition keys. The announcement states: `For example, you can use condition keys to allow only DNS validation.` It also states: `Additionally, you can prevent users from disabling Certificate Transparency (CT) logging or requesting certificates from specific AWS Private Certificate Authorities.` The corresponding entry in the Document history is dated 2023-08-24.	What's New	AWS Certificate Manager introduces Enterprise Controls to help govern certificate issuance
2024-01-09	Deprecated	It was announced that email validation would stop using the WHOIS contacts. The AWS Security Blog article states, `Today, we’re announcing that ACM will be discontinuing the use of WHOIS lookup for validating domain ownership when you request email-validated TLS certificates.` and further states `ACM will continue to send validation emails to the five common system addresses for the requested domain`.	AWS Security Blog	AWS Certificate Manager will discontinue WHOIS lookup for email-validated certificates
2024-02-05	Deprecated	A note about the planned end of WHOIS-based validation was added to the Document history. The heading of the entry is `Upcoming deprecation of WHOIS email verification`, and the text states, `Added a note about the deprecation of WHOIS email verification starting in June 2024.`	Document history	Document history
2024-06	Removed	For newly requested certificates, ACM stopped sending validation emails to the WHOIS contacts. The AWS Security Blog article from 2024-01-09 states, `Starting June 2024, ACM will no longer send domain validation emails by using WHOIS lookup for new email-validated certificates that you request.` The Date is this date in the body of the post; the source does not give the day. The User Guide's email validation page, as of 2026-10-13, states, `ACM no longer supports WHOIS email validation for new certificates or renewals.`	AWS Security Blog	AWS Certificate Manager will discontinue WHOIS lookup for email-validated certificates, AWS Certificate Manager email validation
2024-07-11	Removed	The ACM console no longer supports email validation using MX. The Document history heading is `Deprecation of mail exchanger (MX) email validation`, and the body says `The ACM console no longer supports mail exchanger (MX).` Because the body uses the phrase `no longer supports`, this article classifies the entry as Removed. The body is about the console, and this article has not checked whether the API was also affected.	Document history	Document history
2024-08	Changed	The cross-signing from ACM's publicly issued certificates to the Starfield Class 2 root, managed by GoDaddy, has begun to be removed. An article published on the AWS Security Blog on June 27, 2024, titled `ACM will no longer cross sign certificates with Starfield Class 2 starting August 2024`, states, `The chain length for ACM issued public certificates will reduce from 3 to 2 as part of this change.` The article's FAQ states, `AWS began rolling out these changes in August 2024.` The Date is this date in the FAQ; the source does not give the day. The article includes a note indicating that the `rollout timeline` was updated on October 18, 2024.	AWS Security Blog	ACM will no longer cross sign certificates with Starfield Class 2 starting August 2024
2024-10	Removed	For renewals of existing certificates, ACM stopped sending validation emails to the WHOIS contacts. The AWS Security Blog article of 2024-01-09 states, `Starting October 2024, ACM will no longer send domain validation emails to mailboxes associated with WHOIS lookup for renewal of existing email-validated certificates.` The Date is this date in the body of the post; the source does not give the day. The User Guide's email validation page, as of 2026-10-13, states, `ACM no longer supports WHOIS email validation for new certificates or renewals.`	AWS Security Blog	AWS Certificate Manager will discontinue WHOIS lookup for email-validated certificates, AWS Certificate Manager email validation

2025–2027 — HTTP Validation, Exportable Public Certificates, ACME, and the End of the CT Logging Opt-Out

The features included during this period are detailed in three articles, including How AWS Certificate Manager Issues Public Certificates. The rows are kept short, and the details are left to those articles. The 2027 row is a plan as of the verification date (2026-10-13).

Date	Change	What Happened	Date Source	Source
2025-04-28	Added	Support for verifying domain ownership via HTTP has been added for public certificates used with CloudFront. The announcement states: `ACM uses a domain validation method commonly referred to as HTTP, or file-based validation, to both issue and renew these certificates.` The corresponding entry in the Document history is dated 2025-04-24. Where HTTP validation applies is covered in Section 8 of Moving AWS Certificate Manager Off Email Validation.	What's New	Automated HTTP validated public certificates with Amazon CloudFront
2025-06-11	Removed	AWS Certificate Manager no longer issues certificates with the "TLS Web Client Authentication" (clientAuth) extended key usage (EKU). The User Guide states: `Effective June 11, 2025 AWS Certificate Manager no longer issues certificates with the "TLS Web Client Authentication" (clientAuth) extended key usage (EKU) to align with new browser requirements for website certificates.` For more information, see Section 3.1 of When Public Certificates Stop Carrying clientAuth.	User Guide	AWS Certificate Manager concepts
2025-06-17	Added	Public certificates that can be exported are now available. See How AWS Certificate Manager Issues Public Certificates for details.	What's New	AWS Certificate Manager introduces public certificates you can use anywhere
2025-08-15	Added	The ACM API is now accessible via AWS PrivateLink.	What's New	AWS Certificate Manager supports AWS PrivateLink
2025-12-15	Added	With AWS Controllers for Kubernetes (ACK), you can now provision ACM certificates to Kubernetes Secrets.	What's New	ACM now supports automated certificate management for Kubernetes
2026-02-18	Changed	The validity period for public certificates is now 198 days. The announcement states: `Starting today, public certificates issued from AWS Certificate Manager (ACM) have a maximum validity period of 198 days, compared to previous validity period of 395 days.` Information regarding industry-wide plans to shorten validity periods can be found at TLS Certificate Ecosystem History and Timeline.	What's New	AWS Certificate Manager updates default certificate validity to comply with new guidelines
2026-04-03	Changed	ECDSA certificates without the `keyEncipherment` key usage can now be re-imported. The Document history states: `ACM now allows re-import of ECDSA certificates without the keyEncipherment Key Usage value, in compliance with RFC 5480.`	Document history	Document history
2026-04-07	Added	The `SearchCertificates` API and a search field in the console have been added. The year and month in the announcement URL are `/2026/03/`.	What's New	AWS Certificate Manager now supports native certificate search
2026-06-01	Removed	The ability to stop logging to Certificate Transparency logs on a per-certificate basis has been removed. The Document history entry's heading reads `Certificate transparency logging opt-out deprecated`, and the body states `Certificate transparency logging opt-out is no longer available.` and `The CertificateTransparencyLoggingPreference option is deprecated.` This article classifies the end of the opt-out as Removed. The `CertificateTransparencyLoggingPreference` parameter remains in the API Reference, marked as `This parameter has been deprecated.` The phrase `issued after June 15, 2026` in the same entry refers to the browser's policy date, not the date of this entry.	Document history	Document history, CertificateOptions
2026-06-11	Added	AWS Workload Credentials Provider, which automates the deployment of exported ACM certificates, has been released.	What's New	AWS announces AWS Workload Credentials Provider
2026-07-06	Added	The ability to issue public certificates using ACME has been introduced. The Document history entry is dated 2026-06-18, while the AWS News Blog article is dated 2026-06-30.	What's New	AWS Certificate Manager now supports the ACME protocol for public certificates
2026-08-13	Added	It is now possible to switch the validation method of existing certificates from email to DNS. Details of the switch can be found at Moving AWS Certificate Manager Off Email Validation.	What's New	AWS Certificate Manager supports switching from e-mail to DNS validation
2026-10-06	Added	Support for issuing certificates via ACME through AWS PrivateLink has been added.	What's New	AWS Certificate Manager now supports ACME issuance through AWS PrivateLink
2027-03-31	Scheduled	As of the verification date (2026-10-13), issuance of email-validated certificates is scheduled to end. The announcement from August 13, 2026 states that `ACM will no longer issue email-validated certificates starting March 31 2027, and stop renewing email-validated certificates on September 30 2027.` The Date is the first of the two dates in the body of the announcement. A detailed schedule is available in Section 4.7 of Moving AWS Certificate Manager Off Email Validation.	What's New	AWS Certificate Manager supports switching from e-mail to DNS validation

During this period, the Document history also contains the following entries. Three entries – 2025-07-03, 2025-07-23, and 2025-10-22 – are changes related to clientAuth and are covered in Section 3.1 of When Public Certificates Stop Carrying clientAuth. The entry dated 2026-07-29 reflects the addition of a best practice against including sensitive information in the domain names of public certificates. The entry dated 2026-09-28 documents the addition of a description for ACME’s condition keys.

Where the Dates Differ

The following table lists events for which the dates vary across different sources. In the "Dates by Source" column, dates that have been placed in the main timeline are marked with (timeline). The values in the "Kind of Difference" column correspond to the four categories defined in the previous section.

Event	Dates by Source	Kind of Difference
Integration with CloudFront	What's New 2016-01-21 (timeline). This site's AWS History and Timeline regarding Amazon CloudFront listed the integration with ACM on September 29, 2015, until October 13, 2026. That entry lacked a source link. Among the 16 What's New announcements about CloudFront in 2015 and the 104 results of a full-text search for `Certificate Manager`, this article found no announcement that states an integration with ACM on September 29, 2015. The What's New announcement about CloudFront on September 29, 2015, is `AWS Trusted Advisor adds two new checks for CloudFront`, and one of the two checks is `CloudFront Custom SSL Certificates in the IAM Certificate Store`. The entry in the CloudFront timeline was corrected to January 21, 2016, on October 13, 2026.	Statement not found
Integration with Elastic Beanstalk	What's New 2016-05-23 (timeline), Document history 2017-03-21 (`Added support for AWS Elastic Beanstalk and Amazon API Gateway.`)	Different kinds of dates
Integration with API Gateway	What's New 2017-03-09 (timeline), Document history 2017-03-21 (same entry as for Elastic Beanstalk). This site's AWS History and Timeline regarding Amazon API Gateway also lists March 9, 2017, consistent with the What's New entry.	Different kinds of dates
Integration with CloudFormation	What's New 2016-08-09 (timeline), Document history 2017-05-27 (`Added CloudFormation to Managed automation with integrated services.`)	Different kinds of dates
DNS validation	Document history 2017-11-21, What's New 2017-11-22 (timeline), AWS Security Blog 2017-11-22	Different kinds of dates
The API to opt out of CT logging	AWS Security Blog, date in the body 2018-03-27 (timeline); Document history 2018-03-27. The Security Blog describes the API change, while the Document history describes an addition to the best practices.	Same date, different statements
ACM Private CA	What's New 2018-04-04 (timeline), AWS News Blog 2018-04-04, Document history 2018-04-04. The What's New and AWS News Blog use names related to `ACM Private CA`, while the Document history uses `AWS Private CA` in the heading and `ACM Private Certificate Manager (CM)` in the body.	Same date, different statements
Manual testing of certificate renewal	Document history 2019-03-14, What's New 2019-03-18 (timeline)	Different kinds of dates
IAM condition keys	What's New 2023-08-23 (timeline), Document history 2023-08-24	Different kinds of dates
End of WHOIS-based validation	AWS Security Blog 2024-01-09 (announcement; timeline); Document history 2024-02-05 (note of the plan; timeline); dates in the body of the AWS Security Blog post: June 2024 (new certificates; timeline) and October 2024 (renewals; timeline).	Different kinds of dates
End of Starfield Class 2 cross-signing	AWS Security Blog 2024-06-27 (publication date of the post); date in the post's FAQ, August 2024 (timeline); update note at the top of the post, 2024-10-18.	Different kinds of dates
HTTP validation for certificates used with CloudFront	Document history 2025-04-24, What's New 2025-04-28 (timeline)	Different kinds of dates
Exportable public certificates	What's New 2025-06-17 (timeline), Document history 2025-06-17, AWS Security Blog 2025-06-30	Different kinds of dates
Certificate search	Document history 2026-03-31, What's New 2026-04-07 (timeline). The year and month in the announcement URL are `/2026/03/`.	Different kinds of dates
End of the CT logging opt-out	Document history 2026-06-01 (timeline). The body of the same entry has the browser policy date `issued after June 15, 2026`.	Different kinds of dates
ACME	Document history 2026-06-18, AWS News Blog 2026-06-30, What's New 2026-07-06 (timeline), AWS Security Blog 2026-08-06	Different kinds of dates

The timeline dates for three items—exportable public certificates, certificate search, and ACME—spanning from 2025 to 2026, are consistent with the values found in Section 1.1 of How AWS Certificate Manager Issues Public Certificates, and the dates by source for ACME are consistent with Section 10 of the same article.

Current Overview, Functions, Features of AWS Certificate Manager

This section provides a brief overview of AWS Certificate Manager (ACM) as of the verification date (October 13, 2026). Detailed information on each feature can be found in the articles mentioned in the previous section, as well as in the ACM User Guide.

Domain Validation Methods

The User Guide's page on validating domain ownership, as of October 13, 2026, states:

You can choose to prove your ownership with Domain Name System (DNS) validation, email validation, or HTTP validation when you request a certificate.

Regarding HTTP validation, the same page notes: HTTP validation is available for certificates used with CloudFront. When using email validation, validation emails are sent to five specific addresses: administrator@, hostmaster@, postmaster@, webmaster@, and admin@. They are not sent to the WHOIS contact address.

The CertificateOptions section in the API Reference lists three possible values for ValidationMethod: EMAIL, DNS, and HTTP. As of October 13, 2026, issuance of new email-validated certificates is scheduled to stop starting March 31, 2027, and renewals on September 30, 2027. Domain validation for certificates issued through ACME utilizes a separate system. The User Guide explains:

ACME domain validations are persistent resources configured by PKI administrators that pre-authorize domains for certificate issuance.

Certificate Transparency Logs

The User Guide's concepts page, as of 2026-10-13, states All public certificates issued by ACM are automatically recorded in certificate transparency logs. and Per browser policy requirements, you cannot opt out of certificate transparency logging.

The number of CT logs mentioned varies across different documents. However, each of them counts a different thing.

User Guide's Concepts Page (2026-10-13) — This refers to the number of certificate transparency log servers to which Amazon's CA submits certificates before issuing public certificates. It states it submits the certificate to at least three certificate transparency log servers.
AWS Security Blog Article (2018-04-05) — This refers to the number of logs to which ACM records new and renewed certificates. It states Amazon will log all new and renewed certificates in at least two public logs unless you disable Certificate Transparency logging.
Document history Entry (2026-06-01) — This describes browser policy requirements regarding certificates issued after 2026-06-15. It states logged to at least one Certificate Transparency log.

Key Algorithms and Imported Certificates

The User Guide's page on certificate characteristics, as of October 13, 2026, lists seven key algorithms, and says that ACM can issue new certificates with three of them: RSA_2048, EC_prime256v1, and EC_secp384r1. The section also states, Other algorithms are for imported certificates only. The What's New post of July 14, 2021, states that ACM issues RSA 2048 certificates and that imported ECDSA certificates can now be used with integrated services. ACM gained the capability to issue ECDSA certificates on November 8, 2022.

Integrated Services and Monitoring

The User Guide's page on integrated services, as of October 13, 2026, lists 12 services that support ACM certificates. These include Elastic Load Balancing and CloudFront (since January 21, 2016), Elastic Beanstalk and CloudFormation (since 2016), API Gateway (since 2017), AWS Nitro Enclaves (since 2020), Amazon Elastic Kubernetes Service, Amazon Cognito, AWS App Runner, AWS Amplify, Amazon OpenSearch Service, and AWS Network Firewall. The same page states that certificates issued through ACME cannot be used with these integrated services. As this list may change, it is necessary to verify this page before use.

For monitoring, there are the CloudWatch metric DaysToExpiry (since March 3, 2021) and Amazon EventBridge events.

Frequently Asked Questions about AWS Certificate Manager History

This section answers common questions about the history of AWS Certificate Manager.

When did AWS Certificate Manager launch, and why did another timeline show an earlier date?

AWS Certificate Manager launched on January 21, 2016. Announcements in What's New, articles on the AWS News Blog and AWS Security Blog, and the oldest entry in the User Guide's Document history all reflect this date. On the same day, announcements for CloudFront and Elastic Load Balancing mentioned integration with ACM. While this site's CloudFront timeline included, until October 13, 2026, an entry dated September 29, 2015, that referenced integration with ACM, this article has not found a primary source that gives that date. A CloudFront What's New announcement from September 29, 2015, mentions the addition of a check in AWS Trusted Advisor that allows users to examine CloudFront certificates stored in the IAM certificate store. The entry in the CloudFront timeline was corrected to January 21, 2016, on October 13, 2026.

When did ACM start offering DNS validation, and what did it offer before that?

ACM began offering DNS validation on November 22, 2017, although the related entry in the Document history dates back to November 21, 2017. Prior to that, the announcement says Previously ACM supported only email validation. From January 21, 2016, to November 22, 2017, obtaining a publicly trusted certificate through ACM required verifying ownership via email.

Which email validation methods did ACM remove in 2024, and in what order?

Two methods were removed. One sent validation emails to the WHOIS contacts. This was announced on the AWS Security Blog on January 9, 2024, with a note added to the Document history on February 5, 2024. It was removed for newly requested certificates in June 2024 and for renewals of existing certificates in October 2024. The other method used MX records. A line in the Document history, dated July 11, 2024, states, The ACM console no longer supports mail exchanger (MX). This line refers specifically to the console. The User Guide, as of October 13, 2026, says that validation emails are sent to five specific addresses. Email validation itself is scheduled to end in 2027, as of October 13, 2026.

When did Certificate Transparency logging become the default in ACM, and when did the opt-out end?

Certificate Transparency logging became the default in ACM on April 24, 2018. Prior to that, on March 27, 2018, an API was released that allowed users to disable logging on a per-certificate basis. An AWS Security Blog post published on April 5, 2018, described the behavior from April 24, 2018, with the caveat unless you disable Certificate Transparency logging. On June 1, 2026, the option to disable logging was removed. The Document history states Certificate transparency logging opt-out is no longer available., and the API Reference describes CertificateTransparencyLoggingPreference as This parameter has been deprecated.

Where are ACM's 2025–2026 changes covered?

This article's table for 2025–2027 keeps each row short. Information on exporting public certificates, ACME, and the location and updating of private keys can be found at How AWS Certificate Manager Issues Public Certificates. Details on the end dates for email validation and the switch to DNS are available at Moving AWS Certificate Manager Off Email Validation. When Public Certificates Stop Carrying clientAuth covers clientAuth.

Summary

ACM launched on January 21, 2016, initially offering a service to attach certificates to Elastic Load Balancing and CloudFront through email validation alone. Between 2016 and 2017, integrated services and import functionality were added, followed by DNS validation on November 22, 2017. In 2018, Certificate Transparency (CT) logging became the default, and ACM Private CA was introduced as a feature within ACM. On November 8, 2022, the service gained the ability to issue ECDSA certificates. In 2024, email validation using WHOIS and email validation using MX records through the console were discontinued. Between 2025 and 2026, HTTP validation (for certificates used with CloudFront), the ability to export public certificates, and ACME protocol support were added, while the option to disable CT logging was removed.

⇒ Domain validation methods were added in the order email, DNS, and HTTP (for certificates used with CloudFront). Email validation using WHOIS and email validation using MX records through the console were discontinued in 2024. Email validation itself is scheduled to end in 2027, as of October 13, 2026. WHOIS contact information was removed from the list of recipients for validation emails in June 2024 (new certificates) and October 2024 (renewals).

⇒ CT logging became the default in 2018 and, as of 2026, can no longer be disabled. From April 24, 2018, to June 1, 2026, it was the default, although users could opt out on a per-certificate basis. After June 1, 2026, the User Guide states you cannot opt out of certificate transparency logging.

⚠ The dates for the same events differ by source. What's New indicates the announcement date, the Document history refers to the date the document was updated, blog posts represent the publication date of the article, and for rows where a feature was removed, the date is the one written in the body of the source if the body gives one. When cross-referencing information, it is important to verify which source and date are being used. All information is current as of October 13, 2026.

This timeline will be updated as AWS Certificate Manager continues to evolve.

References:
Tech Blog with curated related content

Written by Hidekazu Konishi