- Newest
- Most votes
- Most comments
Hi Sanha,
to be little bit more concise:
When you request a wildcard certificate, the asterisk (*) must be in the leftmost position of the domain name and than can protect only one subdomain level. For example, *.example.com can protect login.example.com and test.example.com, but it cannot protect test.login.example.com.
Your certificate for *.dev.tripper-global.com is a second-level wildcard, which requires a separate validation process. While ACM supports this, it requires separate CNAME records for each level.
Best regards, Neven
There are several potential reasons why your ACM certificate verification attempts have failed:
For your first attempt with wildcard certificates:
- When using multiple nested subdomains like
*.dev.example.com, you need to ensure you have created the proper DNS zones and records for each subdomain level. You need a subdomain for example.com and another subdomain for dev.example.com before adding the ACM CNAME record. - Wildcard certificates with multiple levels (like
*.dev.example.com) require special attention to DNS configuration.
For both verification attempts:
- Make sure you've copied the CNAME record name and value exactly as provided by ACM, including any underscores or trailing dots.
- Verify that your DNS provider supports CNAME records with underscores (some don't).
- Check if there are any CAA (Certification Authority Authorization) records that might be blocking certificate issuance.
- Ensure your domain is publicly resolvable and the DNS changes have fully propagated (which can take time).
- You can use tools like nslookup or dig to query the CNAME record and verify it matches exactly what ACM expects.
ACM typically attempts to validate a domain for up to 72 hours before timing out. If you're using DNS validation (which is recommended over email validation), ACM will continuously poll for the record and usually detects it within minutes once properly configured.
For nested subdomains specifically, ensure you have the proper DNS hierarchy set up, as this appears to be a common issue with multi-level subdomain validation.
Sources
ACM fails validating DNS record when multiple nested subdomains | AWS re:Post
I have a problem verifying my request for aws certificate. | AWS re:Post
Troubleshoot certificate validation - AWS Certificate Manager
Relevant content
asked 2 years ago
asked 2 years ago
- AWS OFFICIALUpdated 13 days ago

Thank you, neven. that's what i want to know.
Sub domain of sub domain need some specific settings... okay.
Have a good day!