Custom Domain Certificate Not Being Used for API Gateway Mapping

Question

I have one Proxy REST API in API Gateway (Regional) that routes traffic to multiple backend APIs.
* A custom domain is created in API Gateway and uses an ACM certificate (linked the certificate to the custom domain)
* API mapping is configured from the custom domain to the proxy API stage.
* The DNS record points to the API Gateway custom domain name provided.

**Issue:**
When I access the API, the certificate returned is the default AWS certificate (*.execute-api.us-east-1.amazonaws.com) instead of my ACM certificate.
However, the custom domain is validated and shows as "Available" in the console.

**Questions:**
Is there any caching or propagation delay in certificate association?
Are there additional steps needed when mapping only one proxy API rather than mapping individual APIs?

**Goal:**
Use my ACM certificate for the custom domain endpoint instead of the AWS default certificate.

re:Post Agent · Answer

When your custom domain in API Gateway is not using your ACM certificate and is instead serving the default AWS certificate, this is typically due to one of several issues:

1. **Propagation delay**: When you create or update a custom domain with an ACM certificate in API Gateway, it can take up to 1 hour for the changes to fully propagate across AWS infrastructure. If you've recently set up the custom domain or changed the certificate, you may need to wait for this propagation to complete.

2. **DNS configuration**: Ensure that your DNS CNAME record is correctly pointing to the API Gateway domain name provided when you created the custom domain (not the execute-api endpoint). This is a common mistake that can cause certificate issues.

3. **Certificate region**: Verify that your ACM certificate is in the correct AWS region. For regional API Gateway endpoints, the certificate must be in the same region as your API Gateway.

4. **Certificate validation**: Although you mentioned the custom domain shows as "Available" in the console, double-check that the ACM certificate itself is fully validated and active.

5. **API mapping configuration**: The issue is not related to mapping a proxy API versus individual APIs - the certificate association happens at the custom domain level, not the API mapping level.

To resolve this issue:
- Wait at least an hour after making any changes to the custom domain or certificate
- Verify your DNS configuration is pointing to the correct domain name provided by API Gateway
- If needed, you can update the certificate association using the AWS CLI with the `update-domain-name` command to reassign the certificate to your custom domain

If after these steps you still experience issues, you may need to delete and recreate the custom domain with the correct certificate, ensuring proper DNS configuration.  
**Sources**  
[ACM Cert Not Being Honored By Custom Domain in Cognito | AWS re:Post](https://repost.aws/questions/QUfiJ4tYPyT9Kp4a5yz4xgMg/acm-cert-not-being-honored-by-custom-domain-in-cognito)  
[Custom Domain & API Gateway Connection suddenly disconnected. | AWS re:Post](https://repost.aws/questions/QUin468pqjS0GSuNq3OcsCdg/custom-domain-api-gateway-connection-suddenly-disconnected)  
[API Gateway examples using AWS CLI - AWS SDK Code Examples](https://docs.aws.amazon.com/code-library/latest/ug/cli_2_api-gateway_code_examples.html)

Custom Domain Certificate Not Being Used for API Gateway Mapping

Add your answer

Relevant content