ACM Cert Not Being Honored By Custom Domain in Cognito

Question

I previously had a Cognito User Pool set up with a custom domain and everything was working fine, but I had to delete the User Pool and start over because I needed to change required parameters for user sign-up. Now, after recreating everything, I’m running into an issue where Cognito is not using the correct SSL certificate.

I set up a custom domain, auth.example.com, and created a CNAME record in Route 53 pointing to my Cognito domain, your-cognito-id.auth.us-east-1.amazoncognito.com. I also created an ACM certificate covering auth.example.com, validated it via DNS in Route 53, and assigned it to my Cognito custom domain in the AWS Console.

However, when I try to access https://auth.example.com, I get the following error:

Your connection is not private
Attackers might be trying to steal your information from auth.example.com.
NET::ERR_CERT_COMMON_NAME_INVALID

When I inspect the certificate, I see that Cognito is serving an AWS default certificate (*.execute-api.us-east-1.amazonaws.com) instead of my ACM-issued certificate.

To troubleshoot, I tried the following:

Recreated the ACM certificate and validated it successfully.
Deleted and re-added the Route 53 CNAME record.
Reassigned the certificate in Cognito’s custom domain settings.
Cleared my browser cache and waited for DNS propagation.
Despite these steps, I still see the same SSL error.

How can I force Cognito to use the correct ACM certificate? Does Cognito require additional time for the certificate update to take effect? Are there any known issues with Cognito Custom Domains and SSL certificates?

Since this setup worked before, I’m wondering if I missed something when recreating the User Pool. Any help would be greatly appreciated!

Mitch222 · Accepted Answer

Turns out it was a very simple oversight on my part.  I was using the Cognito Domain URI in the CNAME record in Route53 instead of using the Alias Target URI provided when you create a Custom Domain in Cognito.  Once I updated Route53 with the Alias Target value for my CNAME record, all was resolved.

re:Post Agent · Answer

The issue you're experiencing with your Cognito custom domain not using the correct ACM certificate is likely due to a propagation delay. When you replace an existing certificate or set up a new one for your Cognito custom domain, it can take up to 1 hour for Amazon Cognito to fully distribute and apply the new certificate.

Here are some steps to ensure everything is set up correctly and to troubleshoot the issue:

1. Verify that your ACM certificate is in the us-east-1 (N. Virginia) region, as this is required for Cognito custom domains.

2. Double-check that the ACM certificate covers the exact domain name you're using (auth.example.com in this case).

3. Ensure that the CNAME record in Route 53 is correctly pointing to the Cognito domain (your-cognito-id.auth.us-east-1.amazoncognito.com).

4. In the Cognito console, confirm that the custom domain settings are using the correct ACM certificate ARN.

5. After making any changes or reassigning the certificate, wait for at least 1 hour before testing again. Cognito needs this time to propagate the certificate changes.

6. Clear your browser cache and try accessing the domain from different networks or devices to rule out any local caching issues.

If after waiting for an hour and following these steps you still encounter the SSL error, it's possible that there might be an underlying issue with the Cognito service. In this case, it would be advisable to open a support ticket with AWS to investigate further.

Remember that when you provide a new certificate to Amazon Cognito (even if it's for the same domain), ACM assigns it a new ARN. Make sure you've updated the Cognito custom domain settings with this new ARN if you've recreated the certificate.

Lastly, ensure that your application is configured to allow Cognito to add cookies to user sessions, as this is a prerequisite for using custom domains with Cognito user pools.

If the issue persists after following these steps and waiting for the propagation period, contacting AWS support would be the next best course of action to resolve the problem.  
**Sources**  
[Using your own domain for managed login - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-add-custom-domain.html)  
[Delete ACM Cert in Use By CloudFront Distribution after Deleting User Pool | AWS re:Post](https://repost.aws/questions/QUfMOC4SsSRaySWK8nZlhPew/delete-acm-cert-in-use-by-cloudfront-distribution-after-deleting-user-pool)

ACM Cert Not Being Honored By Custom Domain in Cognito

Add your answer

Relevant content