ACM cert verification keep Pending or failed (.de domain)

Question

My website situation:
frontend: S3 + CloudFront,
backend: lambda + API Gateway
**CHECKED**: I have checked the all the settings and also checked the website, works well.
I bought a .de domain on Hostinger, for example: *abcde.de* (only domain name not host). And setup two subdomain as, for example: 
frontend use: *sub.abcde.de* -> CloudFront
backend use: *api.sub.abcde.de* -> API Gateway
And update/add the urls in my code to make it use these.
**CHECKED**: I have checked the DNS propagation, already propagated.
But cannot access the Website, gives 403 ERROR "The request could not be satisfied.", So after googling, it seems the issue of no certificate.
Therefore, I require the ssl certificate on the certificate manager.
1.
Domain: *sub.abcde.de*
Region: us-east-1
method: DNS verificate
then it gives the "CNAME name" and "CNAME value", which I used to add on Hostinger Domain Record Manager. And add successfully.
Then the status keeps "Pending validation".
2.
then I add another as
Domain: *api.sub.abcde.de*
Region: us-east-1
method: DNS verificate
do all the same, still pending validation.
3.
Next, I add the domain **.abcde.de*, do all the same, the status start to show "failed", and I delete *api.sub.abcde.de*, then add again, it shows "failed", then I even add another subdomain, it will always shows "failed". But the first one (I haven't deleted) keep showing "Pending validation".
I browser some similar quesitons on re:Post, but some issue because the .ru, some issue not quite solved. So could anyone give some suggestions? Thanks.

Best,
Cheedge

re:Post Agent · Accepted Answer

I understand you're experiencing issues with ACM certificate validation for your .de domain. Let's address your situation step by step:

1. For the subdomain sub.abcde.de:
The "Pending validation" status is normal initially. ACM uses the CNAME record you added to your DNS configuration to validate your ownership of the domain. This process can take some time, potentially up to 72 hours. If it's been less than that, please be patient and wait a bit longer.

2. For api.sub.abcde.de:
The same applies here. The "Pending validation" status is expected during the validation process.

3. For *.abcde.de and subsequent attempts:
The "failed" status you're seeing could be due to a few reasons:

a) Timing: If you're adding and deleting requests too quickly, it might not give ACM enough time to complete the validation process.

b) DNS propagation: Although you mentioned checking DNS propagation, sometimes it can take longer for changes to fully propagate across all DNS servers.

c) Incorrect CNAME entries: Double-check that you've entered the CNAME records exactly as provided by ACM, including the trailing dot if present.

d) Domain restrictions: Some top-level domains have additional restrictions, but .de domains typically don't have issues with ACM.

Here are some steps you can take:

1. Wait at least 72 hours for the initial requests that are still "Pending validation".

2. For the failed requests, delete them and try again, making sure to carefully add the CNAME records as provided by ACM.

3. Use a DNS lookup tool to verify that the CNAME records are visible and correct from multiple locations.

4. If you continue to have issues after these steps, you may need to contact AWS Support or post in the ACM Discussion Forum for more specific assistance.

Regarding the 403 error you're seeing when trying to access your website, this could indeed be related to the certificate issue, but it could also be due to CloudFront or S3 configuration. Make sure your CloudFront distribution is properly configured to use the new domain and that the S3 bucket policy allows access from CloudFront.

Remember, ACM certificates are valid for 13 months and are automatically renewed if the DNS records remain in place. Once you successfully validate your certificates, you shouldn't need to repeat this process frequently.  
**Sources**  
[Troubleshoot certificate validation - AWS Certificate Manager](https://docs.aws.amazon.com/acm/latest/userguide/certificate-validation.html)  
[Resolve the ACM "validation time out" error | AWS re:Post](https://repost.aws/knowledge-center/acm-validation-time-out)  
[Troubleshoot certificate requests - AWS Certificate Manager](https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-cert-requests.html)  
[Renew ACM managed DNS-validated certificates | AWS re:Post](https://repost.aws/knowledge-center/acm-dns-certificate-renewal)

zak · Answer

This works, the final steps are here

1. Go to ACM, Request a certificate, certificate type public -> click next
2. . Put fully qualified domain name as *.xyz.com or abc.xyz.com .
2. validation method:  DNS validation
3. if you choose email then you must have email like com@xyz.com, Click next
3. Choose algorithm RSA.
5. click request
 your certificate will be create and you will be provided with a CNAME and Value.

Go to your hosting site, like hostinger or godaddy etc. 
Goto cpanel or hpanel
choose your domain
go to DNS record
Create a subdomain with value abc.xyz.com where xyz.com is a domain
to create subdomain just add CNAME = abc.xyz.com and value = your origin URL domain eg. xyz.cloudfront.net
Create CNAME =  VALUE <>
Create another CAA record as below
     NAME : @
      FLAG =0
    TAG = issuewild
     CA Domain = "amazon.com"
 Click = add record

Goback to ACM. you will see the certificate is issued. If not then wait for around 48 hours so that your domain is properly propagated on DNS.

Hope this will help to everybody

cheedge · Answer

Hallo, the Pending validation is still waiting, but it is nearly 72h, not sure it can be varificated successfully. But no matter which domain I request for the cert now, it always be failed.
* DNS propagation CHECKED, already propagated.
* Incorrect CNAME entries. CHECKED, the CNAME name and value are all same as ACM privded, and including the trailing dot.
* IAM role has also add the policy

```
      {
        Effect = "Allow",
        Action = [
          "acm:RequestCertificate",
          "acm:DescribeCertificate",
          "acm:DeleteCertificate",
          "acm:ListCertificates",
          "acm:AddTagsToCertificate",
          "acm:RemoveTagsFromCertificate"
        ],
        Resource = "*"
      }
```
but pending still pending, new request still failed.

And I see some post here, said there are a limit for request for the SSL certificate on ACM, "Each supported Region: 5,000", so it seems I am not reach the limit yet.

And as it seems it will not be successful, and I also turn to Cloudflare origin cert. But it shows the certificate is not trusted...

Could someone give some suggestions? Why it continue failed? Is there other way to get a ssl certificate outside the ACM?

ACM cert verification keep Pending or failed (.de domain)

Add your answer

Relevant content