0

A few years ago I setup an S3 bucket and enabled hosting. It's got an index.html file, which I use as a simple landing page. I then setup AWS CloudFront to use this S3 bucket as an origin server and used the default CloudFront SSL cert. for https. All worked perfectly.

I went to add a new domain name today and Amazon is giving me the following error:

com.amazonaws.services.cloudfront.model.InvalidViewerCertificateException: To add an alternate domain name (CNAME) to a CloudFront distribution, you must attach a trusted certificate that validates your authorization to use the domain name. For more details, see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#alternate-domain-names-requirements (Service: AmazonCloudFront; Status Code: 400; Error Code: InvalidViewerCertificate; Request ID: x)

I then deleted my distribution with 25+ domain names and tried to re-add it, but now Amazon is telling me I need a valid certificate, which I believe means I need one for every domain name. But this wasn't the case prior.

Is there a way to use one default AWS cert. for all my domain names w/this configuration?

Kevin Swindon
  • 1
  • 1

1 Answers1

0

No. This functionality was removed for security reasons. It was possible to set up a distribution which listened to a domain you didn't really control, which could be used for phishing or MitM attacks. The restrictions you've run into are documented here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html#https-requirements-domain-names-in-cert

Alex J
  • 2,844
  • 2
  • 23
  • 24