Cloudfront - multi-tenant - Pending validation for new tenant
Hi,
I point my domains to the "distribution endpoint", and I can see AWS see them, but the certificate still show they are "Pending validation" like you can see in the image I attach:
Now I read here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/managed-cloudfront-certificates.html#tenant-domain-considerations This:
If you have a pending certificate request, CloudFront will respond to requests for the well-known path. While the request is pending, the domain can't be associated with any other CloudFront resources.
So I don't understand why the domain is not confirm by the ACM.
Also this is how the certificate screen is look like - I'm using the redirect validation option:
Thank for any help :)
- Newest
- Most votes
- Most comments
So, I'm not sure what the OP's issue was.. but I had the same pending cert request issue.
Our problem was that we had a WAF (firewall) attached to the Multi-Tenant distribution, and it was blocking the certificate validation bot from accessing the pki-validation path. To fix this we simply added an ALLOW rule for the "/.well-known/pki-validation/*.txt" path.
answered 10 months ago
When you create a CloudFront distribution tenant with a managed certificate, CloudFront automatically requests an HTTP-validated certificate from AWS Certificate Manager (ACM) on your behalf. For the validation to complete successfully, you need to follow specific steps:
-
First, you need to copy the CloudFront routing endpoint from your distribution tenant detail page (or by using the ListConnectionGroups API).
-
To verify domain ownership, you must create a Domain Control Validation (DCV) TXT record with an underscore (_) prefix that points to the CloudFront routing endpoint for your distribution tenant.
-
You also need to update your DNS record to point your domain to the CloudFront routing endpoint for your distribution tenant.
The issue you're experiencing is likely because:
- You may have pointed your domain to the distribution endpoint, but the specific TXT record for domain validation might be missing or incorrectly configured
- DNS propagation might not be complete yet (can take up to 24-48 hours in some cases)
- The TXT record might not have the correct format (it should have an underscore prefix)
For CloudFront to validate your certificate, it needs to verify domain ownership through the TXT record. While you've pointed your domain to the distribution endpoint, which is necessary for routing traffic, the separate TXT record specifically for certificate validation might need to be created or corrected.
While the certificate validation is pending, as you noted, CloudFront will respond to requests for the well-known path, and the domain cannot be associated with other CloudFront resources until validation completes.
To resolve this:
- Double-check that you've created the required TXT record with the underscore prefix
- Verify that the TXT record points to the correct CloudFront routing endpoint
- Allow sufficient time for DNS propagation
- If the issue persists, you might need to check if there are any DNS configuration issues or if the domain is already associated with another CloudFront resource
Sources
Migrate to a multi-tenant distribution - Amazon CloudFront
Request certificates for your CloudFront distribution tenant - Amazon CloudFront
answered a year ago
I update my question, I'm using the redirect validation option and not DNS: Also this is how the certificate screen is look like - I'm using the redirect validation option:
Relevant content
asked 8 months ago
Hello, I'm in the same situation with pending certificates. I can't figure out what I'm doing wrong. Did you ever figure out what the issue was in your case? Thanks.