CloudFront SSL Invalid Error
0
I am distributing the nextjs project through CloudFront.
I have an SSL certificate issued through AWS Certificate Manager. This SSL certificate is connected by route53. And the domain name and certificate are also linked to CloudFront.
However, the following error occurred. What should I fix? Please let me know. Thank you.
Invalid request provided: The specified SSL certificate doesn't exist, isn't in us-east-1 region, isn't valid, or doesn't include a valid certificate chain
✔ Building...
| Site PUBLISH_ASSETS_COMPLETE
| Site site/ServerFunction/AssetReplacer Custom::AssetReplacer UPDATE_COMPLETE
| Site site/S3AssetUploader Custom::S3Uploader UPDATE_COMPLETE
| Site site/RevalidationInsertFunction AWS::Lambda::Function UPDATE_COMPLETE
| Site site/RevalidationFunction AWS::Lambda::Function UPDATE_COMPLETE
| Site site/ImageFunction AWS::Lambda::Function UPDATE_COMPLETE
| Site site/RevalidationResource AWS::CloudFormation::CustomResource UPDATE_COMPLETE
| Site site/ServerFunction/ServerFunction AWS::Lambda::Function UPDATE_COMPLETE
| Site site/Distribution AWS::CloudFront::Distribution UPDATE_FAILED Resource handler returned message: "Invalid request provided: The specified SSL certificate doesn't exist, isn't in us-east-1 region, isn't valid, or doesn't include a valid certificate chain. (Service: CloudFront, Status Code: 400, Request ID: cf266906-2d34-43de-8d3f-b1bd72edafd8)" (RequestToken: 55e0ff90-a2fa-8e90-ea0c-455f681b3453, HandlerErrorCode: InvalidRequest)
| Site site/ServerFunction/AssetReplacer Custom::AssetReplacer UPDATE_COMPLETE
| Site site/S3AssetUploader Custom::S3Uploader UPDATE_COMPLETE
| Site site/RevalidationFunction AWS::Lambda::Function UPDATE_COMPLETE
| Site site/RevalidationInsertFunction AWS::Lambda::Function UPDATE_COMPLETE
| Site site/ImageFunction AWS::Lambda::Function UPDATE_COMPLETE
| Site site/RevalidationResource AWS::CloudFormation::CustomResource UPDATE_COMPLETE
| Site site/ServerFunction/ServerFunction AWS::Lambda::Function UPDATE_COMPLETE
| Site site/Distribution AWS::CloudFront::Distribution UPDATE_COMPLETE
| Site AWS::CloudFormation::Stack UPDATE_ROLLBACK_COMPLETE
⠋ Deploying...
✖ Errors
Site UPDATE_ROLLBACK_COMPLETE
site/Distribution: Resource handler returned message: "Invalid request provided: The specified SSL certificate doesn't exist, isn't in us-east-1 region, isn't valid, or doesn't include a valid certificate chain. (Service: CloudFront, Status Code: 400, Request ID: cf266906-2d34-43de-8d3f-b1bd72edafd8)" (RequestToken: 55e0ff90-a2fa-8e90-ea0c-455f681b3453, HandlerErrorCode: InvalidRequest)
1 Answer
- Newest
- Most votes
- Most comments
2
Hello.
ACM's SSL certificate used with CloudFront must meet the requirements listed in the following documents:
Do you meet all of these requirements?
https://repost.aws/knowledge-center/cloudfront-invalid-viewer-certificate
- The certificate must be imported in the US East (N. Virginia) Region.
- The certificate must be 2048 bits or smaller.
- The certificate must not be password-protected.
- The certificate must be PEM encoded.
Relevant content
- Accepted Answerasked 10 months ago
- Accepted Answerasked 7 months ago
AWS OFFICIALUpdated 9 months ago- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated 9 months ago
Hello, I'm looking forward to your help.
I registered the domain through Route53. A certificate was issued and connected through AWS Certificate Manager. No password or encoding has been changed since the certificate was issued.
-CloudFront linked the us-east-1 certificate (for the Front End screen) -The EC2 load balancer linked the ap-notheast-2 certificate (for API provision through the subdomain)
I distributed the corrections two days ago and there was no problem. The distribution was conducted to reflect the modification one day ago, but the distribution did not proceed due to a certificate error. Currently, it is not possible to access CloudFront distribution url.
By any chance, can I know how to check the size of the certificate? Please let me know what I should check and how to fix it.
I additionally took the following steps, but the same error still occurs.
-I deleted the EC2 load balancer record connected to the subdomain -I deleted the ap-notheast-2 certificate -A new us-east-1 certificate was issued and connected to CloudFront.
Please let me know what I should check and how to fix it.
If the key algorithm is "RSA 2048", you should basically be able to use it without any problems.
I have confirmed that key algorithms have RSA 2048 applied... If it's a normal situation, is there no problem when distributing as below? -CloudFront linked the us-east-1 certificate (for the Front End screen) -The EC2 load balancer linked the ap-notheast-2 certificate (for API provision through the subdomain)
Yes, you should be able to use it normally. By the way, can I configure it if I operate it from the management console? https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-procedures.html#cnames-and-https-updating-cloudfront