A few years ago I setup an S3 bucket and enabled hosting. It's got an index.html file, which I use as a simple landing page. I then setup AWS CloudFront to use this S3 bucket as an origin server and used the default CloudFront SSL cert. for https. All worked perfectly.

I went to add a new domain name today and Amazon is giving me the following error:

com.amazonaws.services.cloudfront.model.InvalidViewerCertificateException: To add an alternate domain name (CNAME) to a CloudFront distribution, you must attach a trusted certificate that validates your authorization to use the domain name. For more details, see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#alternate-domain-names-requirements (Service: AmazonCloudFront; Status Code: 400; Error Code: InvalidViewerCertificate; Request ID: x)

I then deleted my distribution with 25+ domain names and tried to re-add it, but now Amazon is telling me I need a valid certificate, which I believe means I need one for every domain name. But this wasn't the case prior.

Is there a way to use one default AWS cert. for all my domain names w/this configuration?


No. This functionality was removed for security reasons. It was possible to set up a distribution which listened to a domain you didn't really control, which could be used for phishing or MitM attacks. The restrictions you've run into are documented here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html#https-requirements-domain-names-in-cert

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.