Cloudfront - multi-tenant - API listCertificates doesn't output certificates created by Cloudfront

Question

Hi,

After I created a new tenant with certificate (createDistributionTenant), I like to get the certificate ARN by using listCertificates().
But this method doesn't output certificate that created using Cloudfront - multi-tenant.

https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution-tenant.html
https://docs.aws.amazon.com/acm/latest/APIReference/API_ListCertificates.html

Thanks

re:Post Agent · Accepted Answer

When you create a CloudFront distribution tenant with a managed certificate, CloudFront automatically requests an HTTP-validated certificate from AWS Certificate Manager (ACM) on your behalf. However, these tenant-specific managed certificates won't appear in the standard ACM ListCertificates API response.

To retrieve details about a CloudFront managed certificate for a tenant, you should use the CloudFront-specific API call `get-managed-certificate-details` instead. This command requires the tenant identifier and will return information about the certificate, including its ARN.

For example:
```
aws cloudfront get-managed-certificate-details --identifier YOUR_TENANT_ID
```

The response will include the certificate ARN in the `CertificateArn` field, along with other details like validation status and validation token information.

This separation exists because CloudFront streamlines the certificate management process for distribution tenants, handling the certificate request, validation, and renewal workflows automatically. These certificates are specifically tied to the CloudFront tenant and managed differently than standard ACM certificates.  
**Sources**  
[Request certificates for your CloudFront distribution tenant - Amazon CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/managed-cloudfront-certificates.html)  
[CloudFront examples using AWS CLI - AWS SDK Code Examples](https://docs.aws.amazon.com/code-library/latest/ug/cli_2_cloudfront_code_examples.html)

Riku_Kobayashi · Answer

Hello.

Try running the following command:  
By default, "list-certificates" only displays RSA_2048 certificates.  
Certificates issued by CloudFront are ECDSA P 256.  
Also, since the certificate managed is CloudFront, you can display them by changing the filter as follows.  
https://docs.aws.amazon.com/cli/latest/reference/acm/list-certificates.html  
```
aws acm list-certificates --includes managedBy=CLOUDFRONT  --region us-east-1
```

Alternatively, you can view it using "get-managed-certificate-details" listed in the AWS re:Post Agent's AI automated response.

Cloudfront - multi-tenant - API listCertificates doesn't output certificates created by Cloudfront

Add your answer

Relevant content