Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

ACM Certificate for Route 53 Domain Stuck in Pending Validation

0

I’m experiencing a persistent issue with an ACM certificate that remains in Pending validation despite having correct DNS records for several days. What I have verified:

  • The domain is registered in Route 53 (transferred from one.com).
  • The hosted zone name servers match the registrar’s delegation (checked via dig vexita.se NS +short). ns-292.awsdns-36.com. ns-1435.awsdns-51.org. ns-1570.awsdns-04.co.uk. ns-906.awsdns-49.net.
  • The ACM-generated CNAME validation records exist in the hosted zone:
  • Verified using: dig @ns-906.awsdns-49.net _cf0c385ff110afefc16e68d25a94bafa.vexita.se CNAME dig @ns-906.awsdns-49.net _5f06de97f4fd105162a2b8ebdb106eef.www.vexita.se CNAME Both commands return the correct CNAME values. DNS propagation is complete (over two weeks).
  • I also tried deleting and re-creating the certificate and CNAMEs, but the issue persists.

Certificate remains in Pending validation for more than 72 hours, even though DNS records are correct and resolvable from authoritative servers.

Topics
Security, Identity, & Compliance
Tags
AWS Certificate Manager
Language
English

asked a year ago196 views

1 Answer
-1

When an ACM certificate is stuck in "Pending validation" despite having correct CNAME records, there are several potential causes to investigate.

Based on your situation, here are the most likely issues and solutions:

  1. Nameserver Configuration: Even though you've verified that the nameservers match between Route 53 and your registrar, there could still be an issue with the delegation. Since you transferred from one.com, double-check that the domain is fully transferred and using the correct nameservers at the registrar level.

  2. CAA Records: Check if there are any Certification Authority Authorization (CAA) records that might be blocking certificate issuance for your domain. These can prevent ACM from issuing certificates even when DNS validation records are correct.

  3. NS Record Conflicts: One common issue that can cause validation problems is having both NS records and CNAME records for the same name. This creates conflicts in DNS resolution. Check if there are any overlapping records.

  4. Multiple Domain Validation: Since you're requesting a certificate for both the apex domain (vexita.se) and www subdomain (www.vexita.se), ensure that CNAME validation records for both are correctly set up and resolvable.

  5. Validation Timeout: If validation doesn't complete within 72 hours, ACM changes the certificate status to "Validation timed out." Since you've exceeded this window, you should:

  • Delete the pending certificate request
  • Create a new certificate request
  • Add the new CNAME validation records
  • Verify DNS resolution before proceeding
  1. Region Verification: Confirm that the certificate is being requested in the correct region (us-east-1 if you're using it with CloudFront).

Unfortunately, there's no way to force ACM to re-check validation. If creating a new certificate request doesn't resolve the issue after ensuring all the above points are addressed, you may need to contact AWS Support for further assistance.
Sources
ACM certificate stuck in “Pending validation” despite correct DNS CNAMEs | AWS re:Post
ACM certificate stuck in “Pending validation” status despite correct DNS CNAME record in Route 53 | AWS re:Post
Certificate Status still pending validation | AWS re:Post
ACM Certificate Validation Pending indefinitely | AWS re:Post
Forever pending Certificate Validation | AWS re:Post

answered a year ago

  • Tadiwos
    a year ago

    Yes I did all of the above investigations:

    • CNAME validation records exist and resolve correctly via dig.
    • No CAA records are restricting issuance.
    • Nameservers match Route 53 delegation. The domain is fully transferred and using the correct nameservers at the registrar level. I added the domain in Microsoft 365 to use <username>@vexita.se and it works as expected.
    • Certificate and hosted zone are in the same region & correct region (https://us-east-1.console.aws.amazon.com/route53/v2/hostedzones?region=us-east-1)
    • No overlapping records.
    • I did delete and re-requested the certificate couple of times. How do I contact AWS support for further assistance?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content