Skip to content

My AWS ACM verifying something wrong.

0

I already buy a domain (example.com)

I want to make subdomains like this

  • dev.example.com
  • api.example.com
  • api.dev.example.com
  • admin.example.com
  • admin.dev.example.com
  • admin-api.example.com
  • admin-api.dev.example.com

At first time, i made a public CA with wildcard, like below.

  • example.com
  • *.example.com
  • *.dev.example.com After that, i made some dns to subdomains. But, *.dev.example.com is not verified after 24hours.

On now, i made a new public CA like below.

  • admin.example.com
  • admin.dev.example.com
  • admin-api.example.com
  • admin-api.dev.example.com After that, i made some dns to subdomains. But, on now, it still not verified.

My question is

  1. Why my first ACM verification attempt has failed?
  2. Why my second ACM verification attempt has failed?
2 Answers
1
Accepted Answer

Hi Sanha,

to be little bit more concise:

When you request a wildcard certificate, the asterisk (*) must be in the leftmost position of the domain name and than can protect only one subdomain level. For example, *.example.com can protect login.example.com and test.example.com, but it cannot protect test.login.example.com.

Your certificate for *.dev.tripper-global.com is a second-level wildcard, which requires a separate validation process. While ACM supports this, it requires separate CNAME records for each level.

Best regards, Neven

AWS

answered a year ago

EXPERT

reviewed a year ago

  • Thank you, neven. that's what i want to know.

    Sub domain of sub domain need some specific settings... okay.

    Have a good day!

1

There are several potential reasons why your ACM certificate verification attempts have failed:

For your first attempt with wildcard certificates:

  • When using multiple nested subdomains like *.dev.example.com, you need to ensure you have created the proper DNS zones and records for each subdomain level. You need a subdomain for example.com and another subdomain for dev.example.com before adding the ACM CNAME record.
  • Wildcard certificates with multiple levels (like *.dev.example.com) require special attention to DNS configuration.

For both verification attempts:

  • Make sure you've copied the CNAME record name and value exactly as provided by ACM, including any underscores or trailing dots.
  • Verify that your DNS provider supports CNAME records with underscores (some don't).
  • Check if there are any CAA (Certification Authority Authorization) records that might be blocking certificate issuance.
  • Ensure your domain is publicly resolvable and the DNS changes have fully propagated (which can take time).
  • You can use tools like nslookup or dig to query the CNAME record and verify it matches exactly what ACM expects.

ACM typically attempts to validate a domain for up to 72 hours before timing out. If you're using DNS validation (which is recommended over email validation), ACM will continuously poll for the record and usually detects it within minutes once properly configured.

For nested subdomains specifically, ensure you have the proper DNS hierarchy set up, as this appears to be a common issue with multi-level subdomain validation.
Sources
ACM fails validating DNS record when multiple nested subdomains | AWS re:Post
I have a problem verifying my request for aws certificate. | AWS re:Post
Troubleshoot certificate validation - AWS Certificate Manager

answered a year ago

EXPERT

reviewed a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.