- Newest
- Most votes
- Most comments
Based on the detailed information you've provided, it seems you've taken many of the correct steps to troubleshoot this persistent SSL certificate validation issue. However, there are a few additional considerations and steps you might want to explore:
-
Certificate Request Timeout: ACM certificate requests typically time out after 72 hours if not validated. Since it's been 5+ days, it's possible that the pending certificate request has timed out. In this case, you should delete the pending certificate request and initiate a new one.
-
DNS Propagation: Although you've checked with external tools and dig/nslookup, sometimes DNS changes can take longer to propagate fully. Ensure that you've waited at least 30 minutes to an hour after adding or modifying DNS records before rechecking.
-
Hosted Zone Verification: Double-check that the CNAME records are added to the correct hosted zone. Use the 'dig NS' command to verify the nameservers for your domain and ensure they match the nameservers in your Route 53 hosted zone.
-
CAA Records: Verify that there are no Certification Authority Authorization (CAA) records in your DNS that might be blocking certificate issuance for your domain.
-
Multiple Certificates: Having multiple certificates for the same domain can sometimes cause issues. Try focusing on a single certificate that covers both the apex domain and the www subdomain.
-
ACM Console Refresh: Sometimes the ACM console doesn't update immediately. Try refreshing the console or logging out and back in to ensure you're seeing the most up-to-date status.
-
Route 53 and ACM Account Alignment: Ensure that your Route 53 hosted zone and ACM are in the same AWS account. If they're not, you may need to add the CNAME records manually.
-
IAM Permissions: Verify that you have the necessary IAM permissions to create records in your Route 53 hosted zone.
If these steps don't resolve the issue, you may want to contact AWS Support for further assistance. They can investigate if there are any underlying issues with the ACM service or your specific account that might be causing this persistent problem.
Sources
SSL Validation keep on pending | AWS re:Post
Unable to request a Certificate in AWS | AWS re:Post
Route 53, CloudFormation, and ACM | AWS re:Post
Forever pending Certificate Validation | AWS re:Post
Certificate Status still pending validation | AWS re:Post
-
Manual Revalidation: There is no public button or command to manually "force" ACM to revalidate a certificate once it's pending. ACM’s validation service automatically retries in the background every few hours based on its internal schedule. However, when validations get "stuck," background retries sometimes don't trigger correctly.
-
Known Workarounds: Re-issue a new certificate request (which you've already tried — good). Delete and re-add the validation CNAME with a low TTL (which can sometimes reset ACM’s backend state — if you haven't already tried this with a 60s TTL, it’s worth one attempt).
-
Escalation Path: At this point, your best option is to open a support case with AWS under the "ACM Service Limits or Certificate Issue" category.
Relevant content
- asked 3 months ago
- asked 4 months ago
Thank you for the detailed suggestions.
I have already verified all the points you mentioned:
Certificate Request Timeout: The cert is still in Pending Validation status, not Failed or Expired. (Meaning ACM has not timed it out yet.)
DNS Propagation: Confirmed 100% propagation globally via whatsmydns.net and dig/nslookup from multiple regions. Records resolve correctly.
Hosted Zone Verification: NS records match exactly between registrar and Route 53 hosted zone.
CAA Records: No CAA records exist that would block Amazon issuing certificates.
Multiple Certificates: Focused now on a single certificate covering both sdaudit.com and www.sdaudit.com.
ACM Console Refresh: Tried clearing cache, refreshing, logging out/in, etc. No change.
Route53/ACM Account Alignment: Confirmed both are operating under the same AWS account.
IAM Permissions: Full Route53 and ACM permissions confirmed. No access errors encountered.
Since all standard causes have been ruled out, it appears this may be an internal ACM validation issue, not a DNS or permissions problem.
At this point, is there a way to escalate the case or manually trigger re-validation inside ACM? Or is there a known workaround when ACM fails to detect an otherwise-valid CNAME record?
Thank you again for your help.