--- cuppy_hub: aws cuppy_path: reference/acm/certificates.md cuppy_section: docs cuppy_doc: D9DE-JDDT cuppy_doc_uuid: 18f6ad5c-9b0d-455d-9d22-e39f14e07836 cuppy_permalink: https://cuppy.io/aws/d/D9DE-JDDT cuppy_version: 4 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/aws/docs/reference/acm/certificates cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 96f18592f32b930772dbe0565d181597f0a5700f306c9aca5fbd0251bdf6cfa0 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # ACM certificates for load balancers and CloudFront **Request the certificate in the Region of the service that uses it (us-east-1 for any CloudFront distribution) and validate by DNS.** Then leave the validation CNAME in place forever: ACM renews automatically for as long as the certificate is in use and the record exists. ## Which Region | Used by | Certificate Region | |---|---| | CloudFront (viewer HTTPS) | **us-east-1**, whatever Region the origin is in | | ALB / NLB listeners | The load balancer's Region. To use the same names with ELB in several Regions, request a certificate in each; certificates can't be copied between Regions | | CloudFront → an ELB origin over HTTPS | The ELB's certificate can be in any Region (it is the ELB's own) | Each Region's request is validated on its own (the Regions page says you must revalidate each name per Region). The DNS validation token is the same in every Region, though, so a CNAME you already published satisfies the new request, for example the us-east-1 copy CloudFront needs. ## DNS validation ACM gives one CNAME per name: `_.example.com.` → `_.acm-validations.aws.`. A wildcard (`*.example.com`) shares the record of its base domain. Add it once: - **Route 53**: the ACM console offers **Create records in Route 53**. It shows when you can write to the hosted zone and the name isn't yet validated. ACM can't create the record through its own API; create it yourself with Route 53's `ChangeResourceRecordSets` (`reference/route53/records-and-changes.md`). - **Another DNS provider**: enter the name and value. Many providers append the domain automatically: enter only `_`, or the record becomes `_.example.com.example.com.` and validation fails. After the record is in place, the status can stay **Pending validation** for up to 30 minutes. ## Statuses and failures | Situation | Cause → fix | Check | |---|---|---| | **Pending validation** for hours | The CNAME is missing, has the wrong name (double domain), or the DNS provider isn't authoritative for the domain (check the registrar's name servers). Listeners and distributions can't use the certificate yet | `aws acm describe-certificate --certificate-arn --region --query Certificate.DomainValidationOptions[].[ValidationStatus,ResourceRecord]`, then `dig CNAME +short` | | **Validation timed out** | Not validated within **72 hours** of ACM generating the CNAME. Request a new certificate | `aws acm describe-certificate --certificate-arn --region --query Certificate.Status` → `VALIDATION_TIMED_OUT` | | Validation fails through long CNAME chains | More than five chained CNAMEs breaks resolution. Use email validation | `dig CNAME` repeatedly, counting the hops | | A provider rejects names starting with `_` | See ACM's DNS-validation troubleshooting page (not collected) | The provider's record form rejects the name | | Certificate created with email validation | It can't be switched to DNS. Delete and request again with DNS | `aws acm describe-certificate --certificate-arn --region --query 'Certificate.DomainValidationOptions[].ValidationMethod'` | | No authority over the domain's DNS | Use email validation | `dig NS +short` vs the provider you can edit | | Renewal stopped | The certificate is no longer attached to an AWS service, or the CNAME was deleted. Both stop automatic renewal | `aws acm describe-certificate --certificate-arn --region --query 'Certificate.[InUseBy,RenewalEligibility,RenewalSummary]'` | ## Name coverage (the browser errors) - Every name clients use must be in the certificate's SAN, exactly or by a wildcard at the same level (`*.example.com` covers `www.example.com`, not `a.b.example.com`, and not `example.com` itself unless listed). - A load balancer's default `…amazonaws.com` DNS name can't be on a public certificate. Clients must use your own name, or see `NET::ERR_CERT_COMMON_NAME_INVALID`. - CloudFront checks that each **alternate domain name** is covered by the attached certificate before accepting it. ## Keys and imported certificates ACM issues RSA keys up to 2048 bits. CloudFront also accepts imported RSA keys up to 4096 bits, and ECDSA P-256 and P-384. Imported certificates aren't renewed by ACM. Re-import at least 24 hours before `NotAfter`, because CloudFront can take up to 24 hours to pick up the change. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.