Why isn't my AWS ACM certificate validating?

Question

I have a domain name registered in AWS Route53 with an ACM certificate. I am now attempting to both move that domain name and certificate to a new account as well as manage the resources with Terraform. I used the AWS CLI to move the domain name to the new account and it appears to have worked fine. Then I tried running this Terraform code to create a new certificate and hosted zone for the domain.

resource "aws_acm_certificate" "default" {
  domain_name       = "mydomain.io"
  validation_method = "DNS"
}

resource "aws_route53_zone" "external" {
  name = "mydomain.io"
}

resource "aws_route53_record" "validation" {
  name    = aws_acm_certificate.default.domain_validation_options.0.resource_record_name
  type    = aws_acm_certificate.default.domain_validation_options.0.resource_record_type
  zone_id = aws_route53_zone.external.zone_id
  records = [aws_acm_certificate.default.domain_validation_options.0.resource_record_value]
  ttl     = "60"
}

resource "aws_acm_certificate_validation" "default" {
  certificate_arn = aws_acm_certificate.default.arn
  validation_record_fqdns = [
    aws_route53_record.validation.fqdn,
  ]
}

There are two things that are strange about this. Primarily, the certificate is created but the validation never completes. It's still in Pending validation status. I read somewhere after this failed that you can't auto validate and you need to create the CNAME record manually. So I went into the console and clicked the "add cname to route 53" button. This added the CNAME record appropriately to my new Route53 record that Terraform created. But it's been pending for hours. I've clicked that same button several times, only one CNAME was created, subsequent clicks have no effect.

Another oddity, and perhaps a clue, is that my website is still up and working. I believe this should have broken the website since the domain is now owned by a new account, routing to a different hosted zone on that new account, and has a certificate that's now still pending. However, everything still works as normal. So I think it's possible that the old certificate and hosted zone is effecting this. Do they need to release the domain and do I need to delete that certificate? Deleting the certificate on the old account sounds unnecessary. I should just no longer be given out.

I have not, yet, associated the certificate with Cloudfront or ALB which I intend to do. But since it's not validated, my Terrform code for creating a Cloudfront instance dies.

One thing about DNS that's caught me several times: it can take up to 24 hours to completely propagate changes. It may be worth waiting a full day to verify that the changes didn't go through correctly. — Adil B, Jul 10 '20 at 03:00
Sadly not the case. It's been days. I've also deleted the hosted zone on the old account and still it's not validating. — mmachenry, Jul 11 '20 at 05:35

score 6 · Accepted Answer · answered Jul 15 '20 at 06:32

It turns out that my transferred domain came transferred with a set of name servers, however, the name servers in the Route53 hosted zone were all different. When these are created together through the console, it does the right thing. I'm not sure how to do the right thing here with Terraform, which I'm going to post another question about in the moment. But for now, the solution is to change the name servers on either the hosted zone or the registered domain to match each other.

score 1 · Answer 2 · answered Nov 12 '20 at 09:35

It's working for me

######################

data "aws_route53_zone" "main" {
  name         = var.domain
  private_zone = false
}

locals {
  final_domain = var.wildcard_enable == true ? *.var.domain : var.domain
  # final_domain = "${var.wildcard_enable == true ? "*.${var.domain}" : var.domain}"
}

resource "aws_acm_certificate" "cert" {
  domain_name       = local.final_domain
  validation_method = "DNS"

  tags = {
    "Name" = var.domain
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route53_record" "cert_validation" {
  depends_on      = [aws_acm_certificate.cert]
  zone_id         = data.aws_route53_zone.main.id
  name            = sort(aws_acm_certificate.cert.domain_validation_options[*].resource_record_name)[0]
  type            = "CNAME"
  ttl             = "300"
  records         = [sort(aws_acm_certificate.cert.domain_validation_options[*].resource_record_value)[0]]
  allow_overwrite = true
}

resource "aws_acm_certificate_validation" "cert" {
  certificate_arn = aws_acm_certificate.cert.arn
  validation_record_fqdns = [
    aws_route53_record.cert_validation.fqdn
  ]
  timeouts {
    create = "60m"
  }
}

This question was already answered and it was a strange issue from having ported the name servers from a different account so I logged it as an answer once I figured it out. The code, as stated, should have worked as you discovered. But the real issue was the underlying name servers registered to the domain. — mmachenry, Nov 12 '20 at 16:27
When you say "it's working for me", can you give some context? Did it validate in seconds? Minutes? Hours? Trying to understand what to expect here. — mritalian, Feb 15 '21 at 19:11

Why isn't my AWS ACM certificate validating?

2 Answers2