A museum's public ACM certificate on an Application Load Balancer failed to renew after a DNS cleanup deleted the validation records ACM uses for that certificate. What should the team restore?
Select an answer to reveal the explanation.
Short Explanation
Renewal is the landlord asking you to prove you still hold the lease, and the proof went out with the junk mail. You put the ACM DNS validation records back so the certificate can be checked again. A new email certificate or a spare on the listener does not answer the check that is already failing.
Full Explanation
ACM renews a DNS-validated public certificate while the validation records it issued remain in DNS. Those records are how ACM proves the museum still controls the name, so putting the same records back lets this renewal finish without issuing a different certificate. Email validation is another way to request a certificate, and it swaps the renewal path instead of repairing the DNS check that failed. Importing a self-signed certificate does not renew an Amazon-issued certificate, and a load balancer has no setting that skips DNS validation. A second certificate on the listener can serve traffic, but the failed certificate is still not renewed. The validation entries ACM shows are CNAME records, and they have to stay in the zone after issuance or the next renewal fails the same way. Caveat: renewal stays incomplete until ACM can read records whose name and value match that certificate's validation details. Operational check: compare the live DNS records with the certificate's validation entries, then confirm the renewal status leaves the failed state.