ACM Certificate Validation Pending indefinitely

Question

I'm attempting to request a certificate on Certificate Manager as part of a stack deployed using the CDK. The problem is that the certificate stays in the 'Pending Validation' status indefinitely and does not allow my deployment to proceed further until it is 'Issued'. The CNAME record for the certificate is correctly added to the route53 hosted zone that is hosting my domain: 'somedomain.com'. I'm requesting a certificate for name 'app.somedomain.com' and '*.app.somedomain.com'.

If I request the exact same certificate through the console/ui it works perfectly and validation happens in less than a minute or two, most cases. I'm really at a loss here and I'm not sure what I'm doing wrong. Any help is really appreciated, I would be happy to provide additional details.

Here is how I'm requesting the certificate via the CDK:

```
const zone = route53.HostedZone.fromLookup(this, 'Zone', {
      domainName: props.hostedZone
});

const certificate = new acm.Certificate(this, 'SiteCertificate', {
         domainName: props.domainName,
         subjectAlternativeNames: [`*.${props.domainName}`],
         validation: acm.CertificateValidation.fromDns(zone), // Perform DNS validation in the given hosted zone
});
```

Gary Mclean · Answer

Do you  need to specify the hostedZone and region as part of the ACM request?

```
const certificate = new certificatemanager.DnsValidatedCertificate(this, 'Certificate', {
      domainName: domainName,
      hostedZone: hostedZone,
      region: 'us-east-1', // Required for CloudFront
    });
```

MgmtTeam · Answer

I was able to find an answer to this issue and it is now working reliably. I will share it here in case anyone else is having a similar problem that may potentially have a similar root cause. First of all, I had linked a public spoke hosted zone (subdomain) to my main hosted zone (domain).

Main:  somedomain.com 
Sub:    sub.somedomain.com -> NS Record (A,B,C,D)

To link the subdomain to the main domain the NS record from the subdomain needs to exist as an NS record with the same name on the Main Domain. So the Main hosted zone had an NS record created for (sub.somedomain.com) with entries (A,B,C,D).

The certificate I was requesting from the Main domain was for sub.somedomain.com and Subject alternative name *.sub.somedomain.com. Even though route53 was allowing me to create both an NS record as well as an A record of the name (sub.somedomain.com) this was somehow causing the conflict! When I temporarily renamed the NS record of the subdomain or deleted the NS record completely the conflict was resolved and it started to work just fine.

Gary Mclean · Answer

Can you check the CNAME records for the validation are the same when performing with the Console vs SDK as theres no reason why it should fail

re:Post Agent · Answer

The issue you're experiencing with the ACM certificate remaining in 'Pending Validation' status indefinitely when deployed via CDK, while working fine through the console, could be due to a few reasons:

1. DNS Propagation: When using CDK, the process might be moving too quickly, not allowing enough time for DNS changes to propagate. The CNAME records need time to propagate across DNS servers, which can take anywhere from a few minutes to several hours.

2. Permissions: Ensure that your CDK deployment has the necessary permissions to create and modify DNS records in Route 53. The IAM role used for deployment should have sufficient permissions for both ACM and Route 53.

3. Region Mismatch: Verify that the ACM certificate is being requested in the same region where your Route 53 hosted zone is located.

4. Multiple Domains: Since you're requesting a certificate for both 'app.somedomain.com' and '*.app.somedomain.com', ensure that CNAME records for both are correctly added to your Route 53 hosted zone.

5. Nameserver Configuration: Double-check that your domain is using the correct nameservers. You can verify this using DNS lookup tools.

To troubleshoot:

1. Add a wait time in your CDK code after creating the certificate and before proceeding with other resources that depend on it.

2. Manually verify the CNAME records in your Route 53 hosted zone after deployment.

3. Check the ACM console for any specific error messages or validation details.

4. Ensure there are no Certification Authority Authorization (CAA) records blocking certificate issuance for your domain.

If the issue persists, you might need to delete the pending certificate request and initiate a new one. In some cases, the validation process can take up to 72 hours, so patience might be necessary if all other factors have been verified.

Remember, once successfully validated, ACM certificates are valid for 13 months and are automatically renewed if the DNS records remain in place, so this process shouldn't need to be repeated frequently.  
**Sources**  
[Unable to request a Certificate in AWS | AWS re:Post](https://repost.aws/questions/QUYVgR8n5iRkqKZKHuJ95gtw/unable-to-request-a-certificate-in-aws)  
[ACM Certificate is pending all the time | AWS re:Post](https://repost.aws/questions/QU3EN53-enTNuBxriMPLAJfw/acm-certificate-is-pending-all-the-time)

ACM Certificate Validation Pending indefinitely

Add your answer

Relevant content