Route 53, CloudFormation, and ACM

Question

I am not sure what I am doing wrong.   When I first register a domain on Route 53, it assigned me a HostZone.  I had cloud formation distro that was assigned to an s3 bucket.   I registered a certificate through ACM and it was validated.    What I set up was wrong so I had to remove everything from HostZone to cert, to my cloudformation distro and s3 bucket.

After the purge, I recreate an s3 bucket, create a new hostzone, try to use cloud formation distro and now, my ACM keep saying pending validation (it has been 72 hours without error). I tried everything under the sun from checking dig NS  to dig CNAME  to making sure 53 have the correct CNAME, and no A cert is blocking the way. I need cert SSL to work before I move on.

Any idea would be helpful.   I tried researching all of re:Post from newest to dating back to 4 years.   Nothing helped.

EDIT:   I found the solution.   Just copy the NS from the newly hosted zone I created into my Registered Domain NS.   Hosted Zone NS point to Domain.  Domain accepted ACM right away.

Gary Mclean · Answer

You need to update your Glue records for your domain based off the newly created route53 zone. Point 6 n the AI answer.

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.html

I also assume you mean cloudfront not cloud formation.

re:Post Agent · Answer

It sounds like you're experiencing a common issue with AWS Certificate Manager (ACM) validation after recreating your infrastructure. Here are some steps and considerations to help resolve your problem:

1. First, since it's been 72 hours without validation, your certificate request has likely timed out. You'll need to delete the pending certificate and request a new one.

2. When requesting the new certificate, make sure to use DNS validation instead of email validation. DNS validation is more reliable and allows for automatic renewal.

3. After requesting the new certificate, ACM will provide you with CNAME records that need to be added to your Route 53 hosted zone. If you're using the same AWS account for both ACM and Route 53, you should see a "Create records in Route 53" button in the ACM console. This will automatically add the necessary CNAME records to your hosted zone.

4. If the automatic option isn't available, manually add the CNAME records to your Route 53 hosted zone. Ensure you copy the record name and value accurately.

5. After adding the CNAME records, give ACM some time to validate your domain ownership. This process usually completes quickly, but it can take up to 30 minutes for the status to update.

6. Double-check that your Route 53 nameservers are correctly set at your domain registrar. Use the 'dig NS' command to verify this.

7. Ensure there are no Certification Authority Authorization (CAA) records in your DNS that might be blocking certificate issuance.

8. If you're using CloudFormation to manage your ACM certificate, make sure the template includes the correct DomainValidationOptions with the HostedZoneId.

If you continue to face issues after following these steps, you may want to check if there are any DNS propagation delays or if your DNS configuration is correct using tools like dig or nslookup.

Remember, patience is key when dealing with DNS changes. Sometimes, it may take a bit of time for changes to propagate fully.  
**Sources**  
[Certificate not getting issued | AWS re:Post](https://repost.aws/questions/QUV0AznmhGSCeGqLD_Eaqe5w/certificate-not-getting-issued)  
[Unable to request a Certificate in AWS | AWS re:Post](https://repost.aws/questions/QUYVgR8n5iRkqKZKHuJ95gtw/unable-to-request-a-certificate-in-aws)  
[AWS Certificate Manager DNS validation - AWS Certificate Manager](https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html)  
[DNS validation  - pending validation | AWS re:Post](https://repost.aws/questions/QUusU32vkFT42hEcxPx6wqvg/dns-validation-pending-validation)

Route 53, CloudFormation, and ACM

Relevant content