AWS::CertificateManager::Certificate (DNS validation) fails with InternalFailure "Connection pool shut down" since ~2026-06-09 (eu-central-1)

Question

Since 2026-06-09, every CloudFormation create of a DNS-validated ACM certificate in eu-central-1 fails for us with:

Resource handler returned message: "Connection pool shut down" (HandlerErrorCode: InternalFailure)

Failure rate ~15/17 across two days, including 4/4 controlled single-resource test stacks. Email-validated certs are unaffected (4/4 clean).

The failure is machine-regular: CREATE_IN_PROGRESS → Eventual consistency check initiated (+0.5s) → handler logs the computed validation record (+31s) → CREATE_FAILED (+31.2s). CloudTrail shows RequestCertificate succeeds and no route53:ChangeResourceRecordSets is ever attempted — the handler computes the validation CNAME, then crashes on an already-closed
  HTTP client.

Notably, the Eventual consistency check initiated stack event never appeared before 2026-06-09 in any of our cert deploys (dozens since April, all clean) — it arrived together with the failures, which looks like the per-type "optimistic stabilization" handler update being enabled for this resource type. Hosted-zone age/delegation is irrelevant (settled and
  fresh zones fail identically). Roughly 1 in 8 invocations survives.

Sample failed RequestTokens (2026-06-09/10, eu-central-1): 5413b4ae-4037-bf8c-1da4-e544e4a3fd6a, 3c700d2e-83f1-bc88-0aaa-712b359ffcb9, 0c754653-86d6-157e-3368-e5cee9c6e0db, 7b5a297e-109d-31fe-ff76-e2893112f86d

Has anyone else hit this? Can AWS confirm a handler update for AWS::CertificateManager::Certificate around 2026-06-09 and roll back/fix the DNS-validation path? Workaround we're using: pre-create certs via the ACM API and reference with Certificate.fromCertificateArn.

Riku_Kobayashi · Accepted Answer

Hello.

I tried creating an ACM certificate for "eu-central-1" using the following CloudFormation template.  
However, I was unable to reproduce the same problem you experienced.  
I have successfully created an SSL certificate for my AWS account.  
It's possible this is a temporary issue, so how about trying again after some time?  
If the error persists for more than a day, I recommend contacting AWS support.  
Inquiries regarding "Account and billing" are free of charge.  
https://console.aws.amazon.com/support

```
AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  record01:
    Type: String
    Description: domain name
  hostedzoneid:
    Type: String
    Description: Route53 hostedzone id

Resources:
  # ------------------------------------------------------------#
  #  ACM
  # ------------------------------------------------------------#
  ACM:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref record01
      DomainValidationOptions:
        - DomainName: !Ref record01
          HostedZoneId: !Ref hostedzoneid
      SubjectAlternativeNames:
        - !Sub "*.${record01}"
      ValidationMethod: DNS
```

AWS::CertificateManager::Certificate (DNS validation) fails with InternalFailure "Connection pool shut down" since ~2026-06-09 (eu-central-1)

Add your answer

Relevant content