How do I use ACM to troubleshoot the CloudFront distribution "InvalidViewerCertificate" domain name errors?

Resolution

Confirm that your certificate meets all requirements

You receive the following error message:

 "The specified SSL certificate doesn't exist, isn't in us-east-1 region, isn't valid, or doesn't include a valid certificate chain."

To resolve this issue, take the following actions:

• Make sure that the SSL certificate meets the prerequisites to import into ACM and the requirements to use SSL/TLS certificates with CloudFront.
  Note: It's a best practice to request a public certificate from ACM.
• Check your AWS Key Management Service (AWS KMS) policy for an explicit Deny statement. Remove explicit denies for the kms:DescribeKey, kms:CreateGrant, or kms:* actions. Also, grant CloudFront permission to perform the actions.

Also, use the following configurations for the certificate:

• Import the certificate in the US East (N. Virginia) Region.
• Use a certificate key that's 4096 bits or smaller.
• Don't protect the password.
• PEM-encode the certificate.

Use a certificate that includes the CNAME

You receive the following error message:

"To add an alternate domain name (CNAME) to a CloudFront distribution, you must attach a trusted certificate that validates your authorization to use the domain name."

This error occurs when the Subject Alternative Name (SAN) on the certificate doesn't include the CNAME that you specified in the CloudFront distribution.

To resolve this issue, request a public certificate. You can also contact your certificate authority (CA) for an updated certificate that includes the CNAMEs on the distribution.

Use five or fewer certificates

You receive the following error message:

"The certificate that is attached to your distribution has too many certificates in the certificate chain."

This error occurs when you exceed the maximum number of five certificates in the chain. To resolve this issue, use a new certificate chain with five or fewer certificates.

If your current CA doesn't support five or fewer certificates, then request a public certificate.

Get an updated certificate chain

You receive one of the following error messages:

"The certificate that is attached to your distribution has one or more expired certificates in the certificate chain. Make sure that each certificate in the chain is valid for the current date by reviewing the Not Valid After field."

-or-

"The certificate that is attached to your distribution has one or more certificates in the certificate chain that aren't valid yet. Make sure that each certificate in the chain is valid for the current date by reviewing the Not Valid Before field."

If your certificate expired, then you must get an updated certificate chain from your CA. 

Complete the following steps:

1. Download the correct chain files from your CA.
2. Reimport the certificate and chain into either ACM or AWS Identity and Access Management (IAM).
3. Retry your request to create or update your CloudFront distribution.

If your certificate isn't valid yet, then you can't import it. Check the "Not Valid Before" certificate field, and then retry your request.

If you can't retry your request, then request a public certificate.

Use a trusted CA

You receive the following error message:

 "The certificate that is attached to your distribution was not issued by a trusted Certificate Authority."

To resolve this issue, get a certificate from a trusted CA for CloudFront that allows you to use a CNAME record. If your current CA doesn't support this scenario, then request a public certificate.

Note: You can use a self-signed certificate to validate only an existing CNAME record, not a new CNAME record.

Check the formatting in the SAN field

You receive the following error message:

"The certificate that is attached to your distribution has a value in the SAN field that is not correctly formatted."

CloudFront requires that each entry must be either a DNS name that contains a fully qualified domain name (FQDN) or an IP address. Wildcard entries are valid, but you can't add a CNAME that's at a higher or lower level than the wildcard.

If your current CA doesn't support this scenario, then request a public certificate.

Add the CNAME to the API calls

You receive following error message:

"The certificate that you specified doesn't cover the alternate domain name (CNAME) that you're trying to add."

This error occurs when the CNAME that you're trying to associate to your distribution isn't included in the certificate's SAN. To resolve this issue, you must provide the CNAME in the CreateDistribution or UpdateDistribution API calls.

Retry the API calls

You receive the following error message:

"CloudFront encountered an internal error. Please try again."

If you receive the preceding error message when you make the CreateDistribution or UpdateDistribution API calls, then retry the calls. If the issue continues for an extended period of time, then check the AWS Health Dashboard for related issues.

Related information

Why can't I choose a custom SSL/TLS certificate for my CloudFront distribution?