Question

A media company hosts a static website in an S3 bucket served through a CloudFront distribution. The web team, which operates primarily in the eu-west-1 Region, requests an ACM certificate for their custom domain so that the distribution can serve HTTPS traffic. They created a public certificate in ACM in eu-west-1, validated it via DNS, and confirmed its status is 'Issued'. However, the certificate does not appear as a selectable option when they attempt to associate it with the CloudFront distribution. What is the cause and correct remediation?

Accepted Answer

CloudFront only supports certificates that are stored in ACM in the us-east-1 (N. Virginia) Region; request or import the certificate in us-east-1 and associate it with the distribution.

Answer

The certificate must be exported from ACM and manually uploaded to CloudFront, because CloudFront cannot reference ACM-managed certificates directly.

Answer

CloudFront requires certificates issued by AWS Private CA rather than public ACM certificates; reissue the certificate using a private CA.

Answer

The certificate's DNS validation must be redone using email validation, because CloudFront ignores DNS-validated ACM certificates.