AWS Certificate Manager (ACM) certificate request fail (verification)

Question

Hi! 
I've got a domain runorel.ru
I have r53 configured to route it into AWS S3 bucket (static website) and it works under HTTP.
I want to issue SSL certificate to get it working under HTTPS with AWS CloudFront. When I'm using ACM cert request with DNS validation it instantly fails with the following message: "Additional verification required to request certificates for one or more domain names in this request."
The "Learn more" button suggested opening a new thread here (as my support plan is basic).

Answer

Hi Igor,

The certificates issued by AWS Certificate Manager are provided by Certification Authorities (CAs) controlled by [Amazon Trust Services (ATS)](https://www.amazontrust.com/repository/#:~:text=0%2C%20Policy%3A%202.23.140.1.2.1-,Operator%3A%20DigiCert%2C%20Inc.,-CP%2C%20CPS%2C%20and). At the same time, a Subordinate CA of ATS is operated by DigiCert.

DigiCert comply [U.S.-imposed sanctions](https://knowledge.digicert.com/solution/embargoed-countries-and-regions), DigiCert is legally prohibited or restricted from offering its products and services to specific countries or regions.

Due to this restriction, your certificate with `.RU` TLD always got a fail message. I suggest you can buy the certificates from other CAs that are not control by US government.

```
The list of restricted Russia and Belarus TLDs include:
.by
.moscow
.ru
.ru.com
.ru.net
.su
.tatar
.бел
.москва
.рус
.рф
```

Answer

Hi, I have faced this issue in the past. It usually indicates that AWS needs more information to verify your ownership or control of the domain. This step is crucial for the security and integrity of issuing SSL/TLS certificates. You can validate the ownership as follows:

* **DNS Validation:** ACM allows you to use DNS validation as a method to prove domain ownership. ACM will provide you with a CNAME record that you need to add to your domain's DNS configuration in Route 53. This method is preferred because it can automatically renew the certificate.
* **Email Validation:** Alternatively, ACM can send validation emails to the email addresses associated with the domain registrant, as well as the standard addresses (admin@, administrator@, webmaster@, hostmaster@, and postmaster@ your domain name). Ensure you have access to one of these email addresses.

https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html

AWS Certificate Manager (ACM) certificate request fail (verification)

Relevant content