We got CloudHSM working at AWS but it is very expensive, so for now, we are getting a new cert (a year before the old one expires) and hoping the industry solves this in a better way over the next 3 years.