Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

ACM certificate stuck in “Pending validation” — Route 53 hosted in different AWS account from Amplify

0

I have an Amplify app in one AWS account and the Route 53 hosted zone for my domain in another account.

I added the required CNAME record in Route 53 for domain validation, and DNS propagation looks correct (dig confirms the record). However, the ACM certificate requested by Amplify (in us-east-1) stays in “Pending validation” for over 24 hours.

Questions:

  1. Does Amplify support domain validation when Route 53 is in another AWS account?
  2. Is delegating the subdomain (e.g., dev.example.com) with NS records to the Amplify account the correct approach?
  3. Could previously deleted ACM certificates or records still block validation?
  • Roberto Vazquez
    10 months ago

    I'm posting the final answer here in case anyone else faces this frustrating "Pending validation" issue.

    Thank you to @Riku_Kobayashi for your answer.

    The problem was not the cross-account setup but a Broken DNSSEC Chain of Trust on the domain.

    The ACM certificate validation was blocked because of a security conflict:

    • The Conflict: A DS (Delegation Signer) Record was active on the domain registrar.
    • The Block: The Route 53 Hosted Zone had DNSSEC signing disabled.
    • This caused resolvers to reject the validation CNAME as "untrustworthy" (SERVFAIL).

    The Fix:

    The conflicting DS Record was deleted from the domain registration settings.

    After propagation, the security block was removed, and the ACM certificate automatically issued.

Topics
Front-End Web & MobileSecurity, Identity, & ComplianceNetworking & Content Delivery
Tags
AWS Certificate ManagerAmazon CloudFrontAmazon Route 53AWS Amplify
Language
English

asked 10 months ago207 views

1 Answer
0
Accepted Answer

Hello.

Does Amplify support domain validation when Route 53 is in another AWS account?

Since the certificate is issued using ACM, even if the domain is managed by another AWS account, an SSL certificate can be issued as long as the domain validation CNAME record is registered correctly.
It times out after 72 hours, but why not wait until that happens just to be sure?
https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-cert-requests.html

Is delegating the subdomain (e.g., dev.example.com) with NS records to the Amplify account the correct approach?

Setting up is easier if you manage the domain with Route53 using the account that issues the certificate.
The domain itself can be used even if it is managed by a different account.

Could previously deleted ACM certificates or records still block validation?

If the certificates used in the past have been deleted, they should not interfere with the verification.

EXPERT

answered 10 months ago

AWS
EXPERT

reviewed 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content