Cloudfront - multi-tenant - Pending validation for new tenant - Bug

When using CloudFront multi-tenant with certificates, there are a few important things to understand about the validation process:

1. When you create a CloudFront distribution tenant with a managed certificate, CloudFront automatically requests an HTTP-validated certificate from AWS Certificate Manager (ACM) on your behalf. These tenant-specific managed certificates are handled differently than standard ACM certificates.

2. If your certificate is stuck in "Pending validation" status, there could be several reasons:

• DNS propagation may not be complete (can take up to 72 hours in some cases)
• There might be conflicting DNS records
• If you have both a direct domain pointing to your origin and an alias domain pointing to CloudFront, this can sometimes cause validation issues

3. For CloudFront managed certificates, you won't see them in the standard ACM ListCertificates API response. Instead, you should use the CloudFront-specific API call:

aws cloudfront get-managed-certificate-details --identifier YOUR_TENANT_ID

4. If you're trying to view CloudFront-managed certificates using the ACM API, you need to use a specific filter:

aws acm list-certificates --includes managedBy=CLOUDFRONT --region us-east-1

5. Check for any DNS conflicts, particularly if you have NS records and other records (like CNAME records) for the same name, as this can create conflicts in DNS resolution.

If the issue persists, you might need to delete the pending certificate request and initiate a new one, ensuring that your DNS configuration is correctly set up for both domains.
Sources
Cloudfront - multi-tenant - API listCertificates doesn't output certificates created by Cloudfront | AWS re:Post
Certificate Status still pending validation | AWS re:Post
ACM certificate stuck in “Pending validation” status despite correct DNS CNAME record in Route 53 | AWS re:Post
ACM Certificate Validation Pending indefinitely | AWS re:Post