SSL certificate expired on web after auto-renewed in ACM

### Before opening, please confirm:

- [X] I have checked the [custom domains troubleshooting guide](https://docs.aws.amazon.com/amplify/latest/userguide/custom-domain-troubleshoot-guide.html).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-console/blob/master/CONTRIBUTING.md).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

### App Id

arn:aws:amplify:ap-southeast-2:809899173738:apps/daloz45pagf6l

### Region

ap-southeast-2

### Step

Live site

### Status

SSL certificate invalid, despite ACM already renewing it

### Issue or question

I have an Amplify custom domain set up for [mattryall.net](https://mattryall.net), and the wildcard SSL cert hosted by Amazon Certificate Manager (ACM) is not being correctly served by Amplify, after it was renewed automatically.

According to the ACM config, the certificate was automatically renewed on 16 December 2021 (see screenshot below). The CNAME records for auto-renewal are still in place on Route53 and have not been modified.

I haven't deployed a new version of the site or changed any configuration since mid-2021.

It looks like the ELBs or Amplify itself are still serving the old certificate, even after it was renewed. I tried digging into the ELB config, but I can't actually see the ELBs referenced from the certificate resources in the EC2 console (see screenshot below for the ARNs). They must be some kind of secret squirrel Amplify ELBs that don't show up in the console.

My hunch is that there's a missing or flaky eventing system between ACM renewing the certificate and the ELBs or Amplify updating the certificate files they serve.

I have not tried to redeploy the site, which I think may fix the issue, because I wanted to leave the setup for problem diagnosis first.

### Error message

> "*.mattryall.net" certificate is expired.

### Additional information

A prompt response would be appreciated, as I'm leaving my site down and unchanged until you can investigate and confirm the problem.

Thanks,
Matt

Start with the custom domains troubleshooting guide, then inspect the ACM renewal details, Route53 renewal CNAME records, Amplify custom-domain configuration, and the certificate served by the live site. The issue is resolved when the renewed ACM certificate is served for mattryall.net without requiring a redeploy and the expired-certificate error disappears.

Written by the indexing model from the issue text.