Find Expiring ACM Certificates Before They Break HTTPS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListCertificatesAndRegions",
      "Effect": "Allow",
      "Action": ["acm:ListCertificates", "ec2:DescribeRegions"],
      "Resource": "*"
    },
    {
      "Sid": "DescribeCertificates",
      "Effect": "Allow",
      "Action": "acm:DescribeCertificate",
      "Resource": "arn:aws:acm:*:123456789012:certificate/*"
    }
  ]
}

// find-expiring-acm-certificates.ts
// Lists ACM certificates in every enabled Region (always including us-east-1, where CloudFront
// certificates live) that expire within N days, and says whether ACM will renew each one on its own.
// For DNS-validated certificates it also checks that the validation CNAME still resolves.
// Read-only: it never renews, imports or deletes anything.
// Usage: npx tsx find-expiring-acm-certificates.ts [--days 45] [--regions=us-east-1,eu-west-1]
import { resolveCname } from "node:dns/promises";
import { EC2Client, DescribeRegionsCommand } from "@aws-sdk/client-ec2";
import {
  ACMClient,
  DescribeCertificateCommand,
  paginateListCertificates,
  type CertificateDetail,
  type KeyAlgorithm,
} from "@aws-sdk/client-acm";

const args = process.argv.slice(2);
const days = Number(args[args.indexOf("--days") + 1]) || 45;
const regionArg = args.find((a) => a.startsWith("--regions="))?.split("=")[1];

// Without Includes.keyTypes, ListCertificates returns only RSA_1024 and RSA_2048 certificates.
const ALL_KEY_TYPES: KeyAlgorithm[] = [
  "RSA_1024", "RSA_2048", "RSA_3072", "RSA_4096", "EC_prime256v1", "EC_secp384r1", "EC_secp521r1",
];

interface Row { Region: string; Domain: string; Type: string; Expires: string; DaysLeft: number; InUseBy: number; Renewal: string; Action: string }

const bare = (name: string): string => name.replace(/\.$/, "").toLowerCase();

// true if every ACM validation CNAME is still published in public DNS.
async function cnamesInPlace(cert: CertificateDetail): Promise<boolean> {
  const records = (cert.DomainValidationOptions ?? []).map((d) => d.ResourceRecord).filter((r) => r !== undefined);
  const unique = [...new Map(records.map((r) => [bare(r.Name ?? ""), bare(r.Value ?? "")])).entries()];
  for (const [name, value] of unique) {
    try {
      const answers = await resolveCname(name);
      if (!answers.map(bare).includes(value)) return false;
    } catch {
      return false; // NXDOMAIN or no CNAME
    }
  }
  return unique.length > 0;
}

async function action(cert: CertificateDetail, left: number, exported: boolean): Promise<string> {
  const inUse = (cert.InUseBy ?? []).length > 0;
  if (left < 0) return inUse ? "EXPIRED AND IN USE: replace now" : "expired, unused: delete";
  if (cert.Type === "IMPORTED") return inUse ? "reimport a new certificate before expiry" : "imported, unused: delete or reimport";
  if (cert.CertificateKeyPairOrigin === "ACME") return "renewed by your ACME client";
  if (cert.Type === "PRIVATE") return "private CA: check renewal or export";
  if (!inUse && !exported) return "not in use: ACM won't renew";
  const method = cert.DomainValidationOptions?.[0]?.ValidationMethod;
  if (method === "EMAIL") return "approve the renewal email";
  if (method === "DNS") return (await cnamesInPlace(cert)) ? "auto-renew expected" : "validation CNAME missing: renewal will fail";
  return `check ${method ?? "validation"} renewal`;
}

async function scanRegion(region: string): Promise<Row[]> {
  const acm = new ACMClient({ region });
  const rows: Row[] = [];
  const cutoff = Date.now() + days * 86_400_000;
  for await (const page of paginateListCertificates({ client: acm }, {
    CertificateStatuses: ["ISSUED", "EXPIRED"],
    CertificateKeyPairOrigins: ["AWS_MANAGED", "CUSTOMER_PROVIDED", "ACME"], // ACME is excluded by default
    Includes: { keyTypes: ALL_KEY_TYPES },
  })) {
    for (const s of page.CertificateSummaryList ?? []) {
      if (!s.NotAfter || s.NotAfter.getTime() > cutoff) continue;
      const cert = (await acm.send(new DescribeCertificateCommand({ CertificateArn: s.CertificateArn }))).Certificate;
      if (!cert?.NotAfter) continue;
      const left = Math.floor((cert.NotAfter.getTime() - Date.now()) / 86_400_000);
      rows.push({
        Region: region,
        Domain: cert.DomainName ?? "",
        Type: cert.Type ?? "",
        Expires: cert.NotAfter.toISOString().slice(0, 10),
        DaysLeft: left,
        InUseBy: (cert.InUseBy ?? []).length,
        Renewal: cert.RenewalSummary?.RenewalStatus ?? cert.RenewalEligibility ?? "",
        Action: await action(cert, left, s.Exported === true),
      });
    }
  }
  return rows;
}

async function main(): Promise<void> {
  const regions = new Set(regionArg ? regionArg.split(",") : ["us-east-1"]);
  if (!regionArg) {
    const out = await new EC2Client({}).send(new DescribeRegionsCommand({}));
    for (const r of out.Regions ?? []) if (r.RegionName) regions.add(r.RegionName);
  }
  const rows: Row[] = [];
  for (const region of [...regions].sort()) {
    try {
      rows.push(...(await scanRegion(region)));
    } catch (err) {
      console.error(`${region}: skipped (${err instanceof Error ? err.name + ": " + err.message : String(err)})`);
    }
  }
  rows.sort((a, b) => a.DaysLeft - b.DaysLeft);
  console.table(rows);
  const risky = rows.filter((r) => r.Action !== "auto-renew expected");
  console.log(`${rows.length} certificates expire within ${days} days; ${risky.length} need attention.`);
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-acm @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Certificates expiring in the next 45 days, every enabled Region
AWS_PROFILE=readonly npx tsx find-expiring-acm-certificates.ts

# Look further ahead in two Regions
AWS_PROFILE=readonly npx tsx find-expiring-acm-certificates.ts --days 90 --regions=us-east-1,eu-west-1

┌─────────┬─────────────┬───────────────────────┬─────────────────┬──────────────┬──────────┬─────────┬────────────────────────┬───────────────────────────────────────────────┐
│ (index) │ Region      │ Domain                │ Type            │ Expires      │ DaysLeft │ InUseBy │ Renewal                │ Action                                        │
├─────────┼─────────────┼───────────────────────┼─────────────────┼──────────────┼──────────┼─────────┼────────────────────────┼───────────────────────────────────────────────┤
│ 0       │ 'us-east-1' │ 'shop.example.com'    │ 'AMAZON_ISSUED' │ '2026-10-09' │ 12       │ 1       │ 'PENDING_VALIDATION'   │ 'validation CNAME missing: renewal will fail' │
│ 1       │ 'eu-west-1' │ 'legacy.example.com'  │ 'IMPORTED'      │ '2026-10-19' │ 22       │ 2       │ 'INELIGIBLE'           │ 'reimport a new certificate before expiry'    │
│ 2       │ 'eu-west-1' │ 'staging.example.com' │ 'AMAZON_ISSUED' │ '2026-10-25' │ 28       │ 0       │ 'INELIGIBLE'           │ "not in use: ACM won't renew"                 │
│ 3       │ 'us-east-1' │ 'mail.example.com'    │ 'AMAZON_ISSUED' │ '2026-11-02' │ 36       │ 1       │ 'PENDING_VALIDATION'   │ 'approve the renewal email'                   │
│ 4       │ 'us-east-1' │ 'www.example.com'     │ 'AMAZON_ISSUED' │ '2026-11-08' │ 42       │ 1       │ 'PENDING_AUTO_RENEWAL' │ 'auto-renew expected'                         │
└─────────┴─────────────┴───────────────────────┴─────────────────┴──────────────┴──────────┴─────────┴────────────────────────┴───────────────────────────────────────────────┘
5 certificates expire within 45 days; 4 need attention.