Troubleshooting Missing ACM Certificates
Question
You have set up a Cloudfront distribution in AWS.
You want to use the AWS Certificate Manager along with Cloudfront.
You are setting up Cloudfront.
But you cannot see the ACM certificate that you created at an earlier stage to associate with the distribution.
What could be the underlying issue?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Answer - A.
The certificate needs to be configured in the North Virginia region.
This is also given in the AWS Documentation.
Supported Regions.
Visit AWS Regions and Endpoints in the AWS General Reference or the AWS Region Table to see the regional availability for ACM.
Like most AWS resources, certificates in ACM are regional resources.
To use a certificate with Elastic Load Balancing for the same fully qualified domain name (FQDN) or set of FQDNs in more than one AWS region, you must request or import a certificate for each region.
For certificates provided by ACM, this means you must revalidate each domain name in the certificate for each region.
You cannot copy a certificate between regions.
To use an ACM Certificate with Amazon CloudFront, you must request or import the certificate in the US East (N.
Virginia) region.
ACM Certificates in this region that are associated with a CloudFront distribution are distributed to all the geographic locations configured for that distribution.
For more information on regions for ACM, please refer to the below URL:
https://docs.aws.amazon.com/acm/latest/userguide/acm-regions.htmlWhen using the AWS Certificate Manager (ACM) with CloudFront, you may encounter issues in associating the certificate with the distribution. Here are some possible underlying issues:
A. The certificate was not created in the correct region: When creating the certificate in ACM, ensure that you create it in the region where you intend to use it, as ACM certificates are region-specific. If you create the certificate in a different region than the one where your CloudFront distribution is located, you won't be able to see the certificate when you're setting up the distribution.
B. The certificate was not uploaded directly to CloudFront: To associate the ACM certificate with a CloudFront distribution, the certificate must be uploaded directly to CloudFront during the distribution's creation. If you uploaded the certificate to any other service, such as EC2 or Elastic Load Balancer, you won't be able to see the certificate in CloudFront.
C. The CNAME record was not created in Route 53: To use a custom domain name with CloudFront, you need to create a CNAME record in Route 53 that points to your CloudFront distribution. If you haven't created the CNAME record yet, CloudFront won't be able to verify that you own the domain, and the certificate won't be visible.
D. The Alias record was not created in Route 53: To use a custom domain name with CloudFront, you need to create an Alias record in Route 53 that points to your CloudFront distribution. If you haven't created the Alias record yet, CloudFront won't be able to verify that you own the domain, and the certificate won't be visible.
In summary, the underlying issue depends on how the ACM certificate was created, whether it was uploaded to CloudFront directly, and whether the CNAME or Alias record was created in Route 53.
