AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
Cloudfront - multi-tenant - Pending validation for new tenant - Migrate from another services
Hi,
I'm using the new tenant feature and I want to move my existing domains into it. Some of my domains CNAME point directly to my origin server and some point to the new distribution CNAME. Because they are all on the same tenant (using the ALIAS option) the certificate is stuck in a pending-validation status. It will only success to confirm domains that point directly to my origin but not the once the point to the directly to the distribution.
If I have in a tenant only domains that point to my origin or a tenant with only domains that point to the distribution it is working and the certificate is created.
You can see in the image an example how it looks:
- Newest
- Most votes
- Most comments
When migrating domains to a CloudFront multi-tenant distribution, certificate validation can be challenging when mixing domains with different DNS configurations in the same tenant.
The issue you're experiencing occurs because CloudFront's managed certificate validation process requires specific DNS configurations for each domain. When you have some domains pointing directly to your origin server and others pointing to the CloudFront distribution in the same tenant, the certificate validation process gets confused.
For CloudFront to successfully validate and issue a managed certificate for a distribution tenant, you need to:
-
Create a DCV (Domain Control Validation) TXT record with an underscore prefix that points to the CloudFront routing endpoint for your distribution tenant.
-
Ensure your DNS records are properly configured to point to the CloudFront routing endpoint, which you can find on the distribution tenant detail page or by using the ListConnectionGroups API.
The solution to your problem is to separate domains with different DNS configurations into different tenants:
- Keep domains that point directly to your origin in one tenant
- Place domains that point to the CloudFront distribution in another tenant
As you've already discovered, this separation allows the certificate validation to complete successfully for each tenant. This is because each tenant can then have its own properly configured certificate validation process that matches the DNS setup of its domains.
When creating a distribution tenant with a managed certificate request, make sure to:
- Configure the validation token host appropriately
- Verify that your DNS CNAME records are properly propagated before CloudFront can complete the certificate request
This approach will allow you to successfully migrate your domains to the multi-tenant distribution while maintaining proper certificate validation.
Sources
Migrate to a multi-tenant distribution - Amazon CloudFront
CloudFront examples using AWS CLI - AWS SDK Code Examples
answered a year ago
Relevant content
asked a year ago
- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated 10 months ago
