I'd like to create a certificate for an app, that runs on host.domain.com address (but I guess the same holds true for www.domain.com). The app is going to be load balanced, so I've created DNS CNAME record for host.domain.com which points to AWS ELB instance. When creating certificate request I've typed in host.domain.com as the only domain and in next step I've chosen DNS validation (as it seems most convenient). Important note: I'm not using Route53. Here it gets tricky, because AWS Certificate Manager asks me to create CNAME record for _generatedhash.host.domain.com.

The problem is that it appears to be impossible. If I just create sub domain, there will be conflict between CNAME and NS records (which cause zone to be rejected with message: CNAME and other data). I can't move CNAME to sub domain because you can't have CNAME at domain apex level (also rejects zone with message: CNAME and other data).

How actually can I authenticate address host.domain.com with AWS Certificate Manager? Can it be done without Route53?

  • It's not impossible. A CNAME record for _generatedhash.host.domain.com would only conflict with NS records for _generatedhash.host.domain.com. It won't conflict with host.domain.com or domain.com NS records.
    – ceejayoz
    Jul 12, 2018 at 16:47
  • @ceejayoz maybe i wasn't precise enough. The problem is not with _generatedhash conflicting with anything. It is with the fact, that host.domain.com is (and must remain for ELB to work) a CNAME record. How can you create sub domain host.domain.com in such scenario? Jul 12, 2018 at 17:10
  • I'm very confused by your question. Setting up a host.domain.com CNAME record is creating a subdomain.
    – ceejayoz
    Jul 12, 2018 at 17:12
  • @ceejayoz Really? I though CNAME was just an alias and you need explicit delegation with NS records to create sub domain... Jul 12, 2018 at 17:29
  • 2
    No. NS delegation is only needed if you want a different set of nameservers to handle the subdomain's records.
    – ceejayoz
    Jul 12, 2018 at 17:39


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy