Expired SSL/TLS certificates managed in IAM should be removed

How to fix it

Delete expired SSL/TLS server certificates from the IAM certificate store. Take the reference off any load balancer first: AWS warns that Elastic Load Balancing may not notice the deletion, carry on using the certificate and stop accepting traffic. A pass here often means the account has never stored a certificate in IAM at all rather than that nothing has expired, and the evidence line says which. IAM certificates cannot be managed from the console, so this is an API or CLI job.

With the AWS CLI

aws iam delete-server-certificate --server-certificate-name <server-certificate-name>