AWS Certificate requestsucceeds then fails?

Question

Hi,

I initially created a AWS Certificate using domain verification. The DNS record was added a bit late which meant that the initial request failed.

Now I have made new request for the same subdomain but that fails verification. The DNS record name and value are correct (they do not change on new requests), and I noticied that the verification actually succeeds first, but after a refresh the status goes to failed. Is there a way to resolve this?

re:Post Agent · Answer

When an AWS Certificate Manager (ACM) certificate initially succeeds validation but then fails, there are several potential causes and solutions to consider.

This behavior where validation succeeds and then fails can happen due to:

1. DNS configuration changes: If there were any updates to DNS records or zone files after initial validation, it might affect the certificate status.

2. CNAME record issues: The CNAME record for validation must remain in place even after initial validation. If it was removed or modified, validation can fail.

3. DNS propagation inconsistencies: DNS changes can propagate unevenly across the internet, causing intermittent validation results.

4. CAA (Certification Authority Authorization) records: These might be blocking certificate issuance for your domain.

To resolve this issue:

1. Verify your DNS records: Use tools like nslookup or dig to confirm that the CNAME record is correctly set up and globally visible. The record should look like:
_123456.yourdomain.com CNAME _abcdef.acm-validations.aws

2. Ensure exact matching: Copy the record name and value exactly as provided by ACM, including any underscores or periods. Some DNS providers don't allow underscores in CNAME values or might automatically modify entries.

3. Revalidate the certificate: In the ACM console, find your certificate marked as "failed" and click "Revalidate."

4. Allow time for DNS propagation: After confirming your DNS settings are correct, give it some time (up to a few hours) for changes to propagate globally.

5. Delete and create a new request: If revalidation doesn't work, delete the failed certificate request and create a new one. ACM typically attempts to validate a domain for up to 72 hours before timing out.

Remember that the CNAME record must remain in place not just for initial validation but also for automatic certificate renewal, which is one of the major benefits of using DNS validation over email validation.  
**Sources**  
[certificate that has been validated several days ago now appears as failed | AWS re:Post](https://repost.aws/questions/QU3k8xIVyeRDGsNWfSmW5Jtg/certificate-that-has-been-validated-several-days-ago-now-appears-as-failed)  
[I have a problem verifying my request for aws certificate. | AWS re:Post](https://repost.aws/questions/QUSFuavjxeQ4mslFzL0fPPww/i-have-a-problem-verifying-my-request-for-aws-certificate)  
[Unable to request a Certificate in AWS | AWS re:Post](https://repost.aws/questions/QUYVgR8n5iRkqKZKHuJ95gtw/unable-to-request-a-certificate-in-aws)  
[ACM DNS Validation stuck for root domain despite correct CNAME record (sapori.co.za) | AWS re:Post](https://repost.aws/questions/QUV1rYzWHuTJm1pfyXEI-Irw/acm-dns-validation-stuck-for-root-domain-despite-correct-cname-record-sapori-co-za)

AWS Certificate requestsucceeds then fails?

Add your answer

Relevant content