AWS Amplify Hosting custom domain SSL setup

AWS Amplify Hosting secures custom domains with certificates from AWS Certificate Manager (ACM), so the issuing CA is Amazon. The free Amplify managed certificate renews automatically while the app is hosted on Amplify. You can instead select your own certificate imported into ACM in us-east-1.

Wildcard subdomains are supported. On a third-party DNS provider you add one CNAME for ACM validation, one CNAME per subdomain and an ANAME/ALIAS for the root. Steps follow the Amplify Hosting and ACM documentation as of November 2026, with example.com and d111111abcdef8.cloudfront.net as examples.

At a glance

Step 1: Add the domain in the Amplify console

Open the app, choose Hosting > Custom domains and Add domain, and enter the root domain example.com. If the domain is not in Route 53, Amplify offers to create a hosted zone; choose Manual configuration to keep your DNS provider.

By default Amplify creates two entries, https://example.com and https://www.example.com, with a redirect from the root to www. Then choose the certificate:

• Amplify managed certificate for the free default, or
• Custom SSL certificate to pick a certificate from ACM.

Choose Add domain, then open Actions > View DNS records to see the values for your app.

Step 2: Create the DNS records

Add the records soon after adding the domain. ACM starts checking immediately and checks less often over time; records added hours later are the most common reason a domain gets stuck in Pending Verification.

Enter only the host part of the validation name if your provider appends the domain automatically. If your DNS provider has no ANAME/ALIAS support, AWS strongly recommends moving DNS to Route 53. On Cloudflare, whose A records accept only IPv4 addresses, the Amplify troubleshooting page suggests a CNAME at @ (Cloudflare flattens it). With live traffic, change the www and root records only after the domain status shows AVAILABLE. Verification and propagation can take up to 48 hours with third-party DNS.

Keep the validation CNAME forever. Amplify cannot renew the managed certificate if it is modified or deleted.

Step 3: Check CAA records

If the domain publishes CAA records, at least one must allow an Amazon CA:

example.com.  3600  IN  CAA  0 issue "amazon.com"

amazontrust.com, awstrust.com and amazonaws.com are equally valid. During issuance a CAA problem shows up in ACM as One or more domain names have failed validation due to a Certification Authority Authorization (CAA) error. Check with the CAA checker.

Wildcards and custom certificates

Amplify supports wildcard subdomains on custom domains. In Hosting > Custom domains > Domain configuration, add a subdomain named * and map it to a branch; requests for dev.example.com or prod.example.com then reach that branch. The asterisk must be the whole label: *domain.example.com and subdomain.*.example.com are not allowed. By default all Amplify provisioned certificates cover all subdomains of the custom domain.

To use your own certificate:

1. Obtain it from any CA. Amplify supports RSA keys of 1024, 2048, 3072 or 4096 bits and ECDSA P-256 (prime256v1) keys.
2. Import it into ACM, or request it there, in the US East (N. Virginia) us-east-1 Region.
3. Make sure it covers every subdomain you will add; a *.example.com name helps.
4. Select it as Custom SSL certificate when adding or updating the domain.

ACM does not renew imported certificates. Renew at your CA, re-import into ACM, and Amplify refreshes the certificate data for the domain. You can switch between managed and custom certificates at any time.

Verify

A managed certificate shows an Amazon issuer and covers the root and each subdomain you added. Check it with the SSL checker, or:

curl ssl.sh/example.com

Then confirm what CloudFront serves for your name:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer -subject -ext subjectAltName -dates

Do not test the bare cloudfront.net URL: it returns 404 because Amplify routes by hostname.

Renewal

The managed certificate renews automatically as long as the app is hosted on Amplify and the validation CNAME is untouched. Amplify's pages still describe a 13-month certificate, but the ACM documentation now says ACM certificates are valid for 198 days, which fits the 200-day maximum that applies since March 15, 2026 under CA/Browser Forum ballot SC-081v3. The maximum drops to 100 days on March 15, 2027 and 47 days on March 15, 2029. Imported certificates are your responsibility, so put them in ssl.sh monitoring (in development).

Troubleshooting

• Pending Verification (third-party DNS): confirm the CNAMEs resolve with dig or whatsmydns.net. If they exist and still do not resolve, ask the DNS provider or move DNS to Route 53.
• Pending Verification (Route 53): the registered domain's name servers differ from the hosted zone's; make them match.
• Pending Verification (multi-level subdomains): your provider may have appended the domain twice. Try the record name without the SLD and TLD, e.g. _hash.docs.backend instead of _hash.docs.backend.example.com, and wait 15 to 30 minutes.
• CNAMEAlreadyExistsException: the hostname is attached to another CloudFront distribution, in this or another account. Remove it there, wait at least an hour if it was deleted recently, then reconnect.
• Additional Verification Required: ACM needs more information, for example for popular domains; contact AWS Support.
• The requested domain cannot be used by this AWS account. Please contact AWS support for assistance.: a cross-account association. Include a subdomain such as www so Amplify can verify ownership automatically, or add the _amplify-cross-account-ownership-proof TXT record and contact Support.
• SSL certificate or HTTPS errors after you added CAA: ACM cannot update or reissue the certificate. Add an Amazon CAA value, then delete and reconnect the domain (this causes downtime) or ask Support to reissue. See CAA record prevents issuance.