AWS ACM Certificates Renewal Under 45 Days

More Info:

Ensure that your SSL/TLS certificates managed by AWS ACM are renewed 45 days before their validity period ends. Certificate Manager is the AWS service that lets you easily provision, manage, and deploy SSL/TLS certificates for use with other AWS resources such as Elastic Load Balancers, CloudFront distributions or APIs on Amazon API Gateway.

Risk Level

Medium

Address

Security

Compliance Standards

NIST

Triage and Remediation

Cause
Remediation

Check Cause

Using Console

Log in to the AWS Management Console and navigate to the API Gateway service.
In the API Gateway dashboard, select the APIs that you want to examine.
In the API details page, select the “Stages” option from the left-hand side menu.
In the Stages section, under the “SSL certificate” tab, check the expiration date of the ACM certificate. If the certificate is set to expire in less than 45 days, it indicates a misconfiguration.

Using CLI

First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the ACM and API Gateway services.
Once the AWS CLI is set up, you can list all the ACM Certificates using the following command:
```
aws acm list-certificates --region your-region
```
Replace ‘your-region’ with the region where your ACM Certificates are located. This command will return a list of Certificate ARNs.
For each Certificate ARN, you can describe the certificate to get its details, including the expiration date. Use the following command:
```
aws acm describe-certificate --certificate-arn your-certificate-arn --region your-region
```
Replace ‘your-certificate-arn’ with the ARN of the certificate you want to check, and ‘your-region’ with the region where the certificate is located. This command will return the certificate details in JSON format.
You can then parse the JSON output to get the ‘NotAfter’ field, which indicates the expiration date of the certificate. If this date is less than 45 days from the current date, then the certificate is due for renewal. You can use a Python script or a tool like ‘jq’ to parse the JSON output. For example, using ‘jq’:
```
aws acm describe-certificate --certificate-arn your-certificate-arn --region your-region | jq '.Certificate.NotAfter'
```
This command will return the expiration date of the certificate. You can then compare this date with the current date to check if it’s less than 45 days away.

Using Python

Install and configure AWS SDK for Python (Boto3): You need to install Boto3 in your local environment. You can install it using pip:
```
pip install boto3
```
After installing Boto3, you need to configure it. You can configure it using AWS CLI:
```
aws configure
```
It will ask for the AWS Access Key ID, AWS Secret Access Key, Default region name, and Default output format. You can get these details from your AWS account.

Use Boto3 to list all the ACM Certificates: You can use the list_certificates method of ACM client in Boto3 to list all the ACM Certificates. Here is a sample script:

import boto3

def list_certificates():
    client = boto3.client('acm')
    response = client.list_certificates()
    return response['CertificateSummaryList']

certificates = list_certificates()
print(certificates)

This script will print all the ACM Certificates.

Check the renewal status of each certificate: You can use the describe_certificate method of ACM client in Boto3 to get the details of each certificate. Here is a sample script:

import boto3
import datetime

def check_certificate_renewal(certificate_arn):
    client = boto3.client('acm')
    response = client.describe_certificate(CertificateArn=certificate_arn)
    renewal_eligibility = response['Certificate']['RenewalEligibility']
    not_after = response['Certificate']['NotAfter']
    days_to_expiry = (not_after - datetime.datetime.now()).days
    return renewal_eligibility, days_to_expiry

for certificate in certificates:
    renewal_eligibility, days_to_expiry = check_certificate_renewal(certificate['CertificateArn'])
    print(f"Certificate: {certificate['CertificateArn']}, Renewal Eligibility: {renewal_eligibility}, Days to Expiry: {days_to_expiry}")

This script will print the renewal eligibility and days to expiry of each certificate.

Filter the certificates which are eligible for renewal and have less than 45 days to expiry: You can modify the above script to filter the certificates which are eligible for renewal and have less than 45 days to expiry. Here is the modified script:

for certificate in certificates:
    renewal_eligibility, days_to_expiry = check_certificate_renewal(certificate['CertificateArn'])
    if renewal_eligibility == 'ELIGIBLE' and days_to_expiry < 45:
        print(f"Certificate: {certificate['CertificateArn']}, Renewal Eligibility: {renewal_eligibility}, Days to Expiry: {days_to_expiry}")

This script will print only the certificates which are eligible for renewal and have less than 45 days to expiry.

Remediation

Using Console

Sure, I can help you with that. Here are the step-by-step instructions to remediate the AWS ACM Certificates Renewal Under 45 Days misconfiguration using the AWS console:

Log in to your AWS Management Console.
Navigate to the Amazon Certificate Manager (ACM) dashboard.
Select the expired certificate that needs to be renewed.
Click on the “Renew” button.
Review the certificate details and click on the “Next” button.
Choose the validation method for your certificate renewal. You can choose between email validation or DNS validation.
If you choose email validation, enter the email addresses for the domain owner and the technical contact. If you choose DNS validation, you will need to create a CNAME record in your DNS configuration.
Review your renewal information and click on the “Confirm and Request” button.
Wait for the validation process to complete. This may take a few minutes or up to several hours, depending on the method you chose.
Once the validation is complete, your renewed certificate will be issued and available for use.

That’s it! Your AWS ACM certificate has now been renewed and is valid for another year.

Using CLI

If you have an AWS ACM (Amazon Certificate Manager) certificate that is going to expire in less than 45 days, you will need to renew it in order to avoid any service disruptions. Here are the step-by-step instructions on how to remediate this issue using AWS CLI:

Open your terminal or command prompt and make sure you have the AWS CLI installed and configured with your AWS account credentials.
Run the following command to list all your certificates:

aws acm list-certificates

Identify the certificate that needs to be renewed and note down its ARN (Amazon Resource Name).
Run the following command to check the status of the certificate:

aws acm describe-certificate --certificate-arn <certificate-arn>

Check the “NotAfter” field in the output of the above command to see the expiration date of the certificate.
If the certificate is going to expire in less than 45 days, run the following command to renew it:

aws acm renew-certificate --certificate-arn <certificate-arn>

Once the renewal request is submitted, you will receive a confirmation email from AWS. Follow the instructions in the email to complete the renewal process.
After the certificate is renewed, you will need to update it in your application or web server to avoid any service disruptions.

That’s it! By following these steps, you will be able to remediate the issue of AWS ACM certificates renewal under 45 days using AWS CLI.

Using Python

First, you need to install the AWS SDK for Python (Boto3) and configure your AWS credentials on your local machine.
Next, you need to write a Python script that will use the Boto3 library to check the expiration date of all ACM certificates in your AWS account.
You can use the boto3.client('acm').list_certificates() method to list all the certificates in your account.
Then, you can loop through each certificate and check if its expiration date is less than 45 days from the current date using the datetime module.
If a certificate is about to expire, you can use the boto3.client('acm').renew_certificate() method to renew it.
Finally, you can schedule the script to run periodically using a tool like AWS Lambda or cron.

Here is a sample Python code to get you started:

import boto3
from datetime import datetime, timedelta

# Set the AWS region and create an ACM client
region = 'us-east-1'
acm = boto3.client('acm', region_name=region)

# Get the list of all certificates in the account
certificates = acm.list_certificates()['CertificateSummaryList']

# Loop through each certificate and check if it needs to be renewed
for cert in certificates:
    cert_arn = cert['CertificateArn']
    cert_info = acm.describe_certificate(CertificateArn=cert_arn)['Certificate']
    expiration_date = cert_info['NotAfter']
    days_left = (expiration_date - datetime.now()).days

    if days_left < 45:
        # Renew the certificate
        acm.renew_certificate(CertificateArn=cert_arn)
        print(f'Renewed certificate {cert_arn}')

Note: Make sure to test the script in a non-production environment before running it on your production AWS account.

Additional Reading:

https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html

Documentation Index

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Check Cause

​Remediation

​

​Additional Reading: