ACM certificate stuck in “Pending validation” despite correct DNS CNAMEs

The authoritative nameservers for gorillabricc.com are managed by NameCheap. The authoritative nameservers for www.gorillabricc.com are set to Route53. If you issued a cert for the apex domain (no 'www'), then that would explain the validation issue. Setting Route53 nameservers as authoritative can be accomplished by using the "custom DNS" option in NameCheap.

https://www.namecheap.com/support/knowledgebase/article.aspx/767/10/how-to-change-dns-for-a-domain/

See this re:Post article for further info: https://repost.aws/knowledge-center/route-53-validate-acm-certificates

A similar issue was described here: https://repost.aws/questions/QU9fQaXP-JT3CxrJkTiYtCoA/acm-certificate-stuck-in-pending-validation-status-despite-correct-dns-cname-record-in-route-53

When an ACM certificate is stuck in "Pending validation" status despite having the correct CNAME records, there are several potential causes to investigate:

1. Validation Timeout: If validation doesn't complete within 72 hours, ACM changes the certificate status to "Validation timed out." Since you've waited over 96 hours, you may need to delete the failed request and create a new one.

2. DNS Configuration Issues: Check for these common problems:

• Ensure there are no Certification Authority Authorization (CAA) records blocking certificate issuance for your domain
• Verify that all domains in your certificate request (both gorillabricc.com and www.gorillabricc.com) have their respective CNAME validation records properly set up
• Check for NS record conflicts - having both NS records and CNAME records for the same name can create DNS resolution conflicts

3. Nameserver Configuration: Verify that your domain is using the correct nameservers. One common issue is when the nameservers configured at your domain registrar don't match the nameservers shown in your Route 53 hosted zone.

4. Region Verification: Confirm that the certificate is being requested in the correct region (us-east-1) for CloudFront usage.

Unfortunately, there's no way to force ACM to re-check validation. At this point, since you've exceeded the 72-hour validation window, your best option is to:

1. Delete the pending certificate request
2. Create a new certificate request
3. Add the new CNAME validation records
4. Verify DNS resolution with nslookup or dig before proceeding

If the issue persists with a new certificate request, you may want to contact AWS Support for further assistance.
Sources
ACM certificate stuck in “Pending validation” status despite correct DNS CNAME record in Route 53 | AWS re:Post
Troubleshoot DNS validation problems - AWS Certificate Manager
AWS Certificate Manager DNS validation - AWS Certificate Manager
ACM Certificate Validation Pending indefinitely | AWS re:Post