Certificate pinning problems - Amazon Certificate Manager
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Certificate pinning problems

To renew a certificate, ACM generates a new public-private key pair. If your application uses Certificate pinning, sometimes known as SSL pinning, to pin an ACM certificate, the application might not be able to connect to your domain after Amazon renews the certificate. For this reason, we recommend that you don't pin an ACM certificate. If your application must pin a certificate, you can do the following:

  • Import your own certificate into ACM and then pin your application to the imported certificate. ACM doesn't provide managed renewal for imported certificates.

  • If you're using a public certificate, pin your application to all available Amazon root certificates. If you're using a private certificate, pin your application to the CA's root certificate.