With DNS validation, ACM provides a CNAME for each name (_4a7c….www.darsakan.ma →
_9d2e….acm-validations.aws) and waits to find it in public DNS, as proof that you control the
domain. ACM never writes it on its own into Route 53, even when the zone is in the same
account: you have to click “Create records in Route 53” in the console, or create them yourself.
Here, the zone contains no _4a7c… and no _7e2b…: the certificate stays
PENDING_VALIDATION (and will fail after 72 hours).
The CAA authorizes amazon.com, the NS delegation matches the Route 53 zone, and DNS validation
usually completes within minutes once the CNAME is published.
Incident resolved
Analysis and fix
Fix: publish the two CNAMEs given by describe-certificate:
aws route53 change-resource-record-sets --hosted-zone-id Z05829174MBNQ3XKT6W1E --change-batch file://validation-acm.json.
After a few minutes, the certificate becomes ISSUED; then add the HTTPS listener:
aws elbv2 create-listener --load-balancer-arn … --protocol HTTPS --port 443 --certificates CertificateArn=arn:aws:acm:eu-west-3:451093827164:certificate/9b2d4f6a-8c1e-4a3b-b5d7-e9f1a3c5b7d2 --default-actions Type=forward,TargetGroupArn=…,
then redirect HTTP to HTTPS.
To prevent it from happening again:
- leave the validation CNAMEs in place: ACM uses them to renew the certificate automatically every year;
- create the certificate and the CNAMEs together as infrastructure as code (Terraform
aws_acm_certificate_validation, CloudFormation withHostedZoneId); - request the certificate several days before a launch, and check its status in the go-live checklist;
- set an alarm on ACM certificates approaching expiry (
DaysToExpiry).