Why doesn't my certificate in Certificate Manager appear or update in my CloudFront distribution?

Short description

This issue might occur for one of the following reasons:

• The certificate didn't update after renewal or reimport.
• The certificate doesn't appear or is grayed out in the CloudFront console.
• AWS Trusted Advisor reports an alert for your CloudFront SSL certificate.

Check that the Amazon Resource Name (ARN) of the certificate that's attached to your distribution is correct. Also, check that you imported the updated certificate to the same ARN. If the certificate doesn't appear in the list, then confirm that the certificate is public, in the US East (N. Virginia) AWS Region, and has an Issued status.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

The certificate shows the old expiration date after renewal or reimport

After you renew or reimport an ACM certificate, CloudFront processes the update asynchronously. It can take up to 24 hours for CloudFront to show the changes. During this time, CloudFront might still use the previous certificate.

Run the following get-distribution AWS CLI command to confirm that the distribution is associated with the correct ARN:

aws cloudfront get-distribution --id DISTRIBUTION_ID --query 'Distribution.DistributionConfig.ViewerCertificate.ACMCertificateArn'

Note: Replace DISTRIBUTION_ID with your CloudFront distribution ID.

If the ARN is correct but the certificate hasn't updated after 24 hours, then complete the following steps:

1. Open the CloudFront console.

2. Select the name of your distribution.

3. Under the General tab, choose Edit.

4. Under Custom SSL certificate, select a different certificate that covers the same alternate domain names.

5. Choose Save.
   Note: Wait for the distribution status to change to Deployed.

6. Repeat steps 2 and 3

7. After you complete step 3, select your updated certificate.

8. Choose Save.
   Note: If you don't have a second certificate available, then temporarily remove the alternate domain names from the distribution and then re-add them with the updated certificate. Custom domain traffic is unavailable until you add back the alternate domain names.

9. For imported certificates, run the following describe-certificate AWS CLI command to confirm that you reimported to the same ARN:

   aws acm describe-certificate --certificate-arn arn:aws:acm:us-east-1:111122223333:certificate/12345678-1234-1234-1234-123456789012 --region us-east-1 --query 'Certificate.{NotAfter:NotAfter,ImportedAt:ImportedAt}'

   Note: Replace 111122223333 with your AWS account ID and 12345678-1234-1234-1234-123456789012 with your certificate ID.

When you reimport a certificate to the same ARN, ACM preserves the service associations of the original certificate. Renew or reimport your certificate at least 24 hours before the NotAfter value of your current certificate. If CloudFront still shows the previous certificate, then follow the instructions in Why does CloudFront show my old Amazon-issued SSL certificate after I renewed or reimported the certificate?

The certificate doesn't appear in the CloudFront console

Confirm that your certificate meets the following requirements:

• Make sure that you requested or imported the certificate in the US East (N. Virginia) Region.
• Confirm that the certificate status has an Issued status.
• Make sure that the certificate is public.
  Note: CloudFront doesn't support ACM Private CA certificates for HTTPS between viewers and CloudFront.
• For imported certificates, verify that the issuing CA is on the Mozilla-included CA certificate list.
  Note: CloudFront doesn't accept certificates from private or internal enterprise CAs.

You can't move or copy existing certificates between Regions. Request or import a new certificate in the US East (N. Virginia) Region. To migrate an existing certificate, see How do I associate my SSL certificate in the US East (N. Virginia) Region to use with my CloudFront distribution?

The certificate is greyed out in the CloudFront console

Check if continuous deployment is active on your distribution. Note that if continuous deployment is active, then you can't edit the SSL certificate field.

To change the certificate, complete the following steps:

1. Update the CloudFront distribution to remove the continuous deployment policy.
2. Delete the continuous deployment configuration entirely.
   Note: It isn't sufficient to deactivating the configuration.
3. Change the certificate.
4. Re-create continuous deployment.

Trusted Advisor reports an "Unable to retrieve" alert for CloudFront SSL certificate

Trusted Advisor checks the SSL/TLS certificates for HTTPS between CloudFront and your origin on your origin server. Trusted Advisor doesn't check the ACM certificate that's associated with your distribution for HTTPS between viewers and CloudFront. Alerts include expired certificates, certificates that expire within 30 days, and incomplete certificate chains.

If Trusted Advisor can't connect to your origin to validate the certificate, then you might receive the "Unable to retrieve the origin certificate" error message. This can happen if the origin is behind a firewall or security group that blocks external access. It can also happen when the origin certificate chain is incomplete. Missing intermediate certificates cause an incomplete chain. For the correct chain format, see Intermediate certificates.

Run the following openssl command to check the connection and certificate chain on your origin:

openssl s_client -connect ORIGIN_DOMAIN:443 -servername ORIGIN_DOMAIN -showcerts

Note: Replace ORIGIN_DOMAIN with your origin's domain name.

In the output, confirm that the full certificate chain is present, and includes intermediate certificates.

If the origin isn't reachable from external networks by design, then exclude the finding in Trusted Advisor. To troubleshoot origin SSL/TLS negotiation failures, see How do I resolve the "CloudFront wasn't able to connect to the origin" error?

Related information

Check a certificate's renewal status

Troubleshooting managed certificate renewal

Requirements for using SSL/TLS certificates with CloudFront

AWS Region for AWS Certificate Manager

Appendix B - Edge network global service guidance