SSL certificate renewal responsibilities differ by certificate type in AEM as a Cloud Service
This article outlines how SSL certificate renewal is handled for Adobe-managed domains in Adobe Experience Manager as a Cloud Service and clarifies whether customer action is required.
Description description
Environment
- Adobe Experience Manager as a Cloud Service
- Cloud Manager SSL certificates for Adobe-managed DV certificates or customer-managed OV/EV certificates
Issue/Symptoms
- A monitoring tool reports that an SSL certificate associated with an Adobe-managed domain is approaching expiration.
- No service outage or certificate-related errors are observed.
- The alert is generated because the monitoring tool detects that the current certificate is nearing its expiration date.
Cause
Certificate renewal responsibility depends on certificate type. Adobe-managed DV certificates in Cloud Manager renew automatically every three months unless the certificate is deleted. For CNAME-based validation, the required DNS validation CNAME must remain in place for renewal. Customers renew customer-managed OV/EV certificates and upload the replacement in Cloud Manager.
Resolution resolution
Follow the steps below to address the issue:
-
Identify the domain and certificate type:
- For an Adobe-provided AEM environment hostname, Adobe manages the certificate; you don’t renew it yourself.
- For a customer custom domain, check the certificate’s ownership and type in Cloud Manager: Adobe-managed DV or customer-managed OV/EV.
-
Follow the renewal path for the certificate:
- For an Adobe-managed DV certificate, Adobe renews the certificate automatically every three months unless it is deleted. If the domain uses CNAME-based validation, keep the required DNS validation CNAME record in place.
- For a customer-managed OV/EV certificate, obtain the renewed certificate from your certificate authority and upload it in Cloud Manager.
-
For an expiry alert, check the certificate status in Cloud Manager and rerun the TLS validation from the monitoring tool that generated the alert. Cloud Manager displays certificate status and expiration warnings in its UI; it doesn’t send proactive email or Action Center notifications for expiring domain-mapping certificates.
-
If the site has access issues or the alert remains after the certificate renewal, contact Adobe Support.
-
If Adobe Support needs to investigate, provide the hostname checked, alert timestamp, certificate issuer and serial number or fingerprint, alert source, and observed certificate chain through your Support case. Don’t post these certificate-identifying details in a public article or forum.