How are you all doing aws ssl certificate management across accounts?

most of my stuff is on cloudways but two clients sit on aws, and every certificate headache i have had this year came from there. not because acm is bad. because a cert can live in four places and only some of them renew themselves.

what bit me, roughly in order:

\- a cloudfront distribution needs the cert in us-east-1 no matter where the rest of the stack lives. i put one in eu-west-1 and spent half an hour wondering why the dropdow was empty

\- acm only auto renews a cert it issued and that still has its validation cname in dns. a client moved dns to cloudflare, the team copied the a records and the mx and nothing else, and 11 months later the renewal silenty failed

\- an imported cert never renews. it just expires, and nothing tells you unless you wired up the eventbridge rule yourself

\- a cert attached to nothing does not renew either, which is fine until the thing you detached last month is the alb you are about to reattach

The fix was mostly not technical. every validation cname now lives in the same terraform as the record it validates, so it cannot be copied without being copied. and there is one eventbridge rule per account on ACM Certificate Approaching Expiration going to an sns topic that emails me. 45 days is the default which is plenty, you only really need an hour, but the 45 day email is the one that catches the imported cert that will never fix itself.

what i would tell my past self is that aws ssl certificate management is an inventory problm before it is a technical one. i wrote a script that lists every cert in every region across both accounts with status and expiry into a csv, run it monthly, and that csv has caught more than any dashboard did. two orphans, one imported cert nobody remembered, and a wildcard on a domain the client had already sold.

also the console lies a little. a cert can show issued and still be useless because the chain your origin serves is the old one. curl -vI the origin directly, not through cloudfront, or you are testing the cdn's cert instead of yours.