# AWS Amplify custom domain SSL: ACM certificates and fixes > Connect a custom domain to AWS Amplify with a managed or imported ACM certificate: DNS records, Amazon CAA values, wildcards and fixes. Source: https://ssl.sh/guides/aws-amplify-custom-domain-ssl/ Last updated: 2026-11-10 AWS Amplify Hosting secures custom domains with certificates from AWS Certificate Manager (ACM), so the issuing CA is Amazon. The free Amplify managed certificate renews automatically while the app is hosted on Amplify. You can instead select your own certificate imported into ACM in `us-east-1`. Wildcard subdomains are supported. On a third-party DNS provider you add one CNAME for ACM validation, one CNAME per subdomain and an ANAME/ALIAS for the root. Steps follow the Amplify Hosting and ACM documentation as of November 2026, with `example.com` and `d111111abcdef8.cloudfront.net` as examples. ## At a glance | Question | AWS Amplify Hosting | |---|---| | CA for automatic certificates | Amazon (certificate generated by ACM) | | Validation | DNS: a CNAME to an `acm-validations.aws` name | | Root (`example.com`) | `ANAME`/`ALIAS` to the app's CloudFront domain (or Route 53 alias) | | `www` and other subdomains | `CNAME` to the app's `cloudfront.net` domain | | CAA must allow | `amazon.com`, `amazontrust.com`, `awstrust.com` or `amazonaws.com` (at least one) | | Wildcard | Yes: wildcard subdomains; managed certificates cover all subdomains | | Your own certificate | Yes, from ACM in `us-east-1`; imported certificates are not renewed by ACM | | Renewal | Automatic for the managed certificate | ## Step 1: Add the domain in the Amplify console Open the app, choose **Hosting > Custom domains** and **Add domain**, and enter the root domain `example.com`. If the domain is not in Route 53, Amplify offers to create a hosted zone; choose **Manual configuration** to keep your DNS provider. By default Amplify creates two entries, `https://example.com` and `https://www.example.com`, with a redirect from the root to `www`. Then choose the certificate: - **Amplify managed certificate** for the free default, or - **Custom SSL certificate** to pick a certificate from ACM. Choose **Add domain**, then open **Actions > View DNS records** to see the values for your app. ## Step 2: Create the DNS records Add the records soon after adding the domain. ACM starts checking immediately and checks less often over time; records added hours later are the most common reason a domain gets stuck in **Pending Verification**. | Purpose | Type | Name | Value | |---|---|---|---| | ACM validation | `CNAME` | `_c3e2d7eaf1e656b73f46cd6980fdc0e` | `_cjhwou20vhu2exampleuw20vuyb2ovb9.j9s73ucn9vy.acm-validations.aws` | | `www` | `CNAME` | `www` | `d111111abcdef8.cloudfront.net` | | Root | `ANAME` or `ALIAS` | `@` | `d111111abcdef8.cloudfront.net` | Enter only the host part of the validation name if your provider appends the domain automatically. If your DNS provider has no ANAME/ALIAS support, AWS strongly recommends moving DNS to Route 53. On Cloudflare, whose A records accept only IPv4 addresses, the Amplify troubleshooting page suggests a CNAME at `@` (Cloudflare flattens it). With live traffic, change the `www` and root records only after the domain status shows **AVAILABLE**. Verification and propagation can take up to 48 hours with third-party DNS. Keep the validation CNAME forever. Amplify cannot renew the managed certificate if it is modified or deleted. ## Step 3: Check CAA records If the domain publishes CAA records, at least one must allow an Amazon CA: ```dns example.com. 3600 IN CAA 0 issue "amazon.com" ``` `amazontrust.com`, `awstrust.com` and `amazonaws.com` are equally valid. During issuance a CAA problem shows up in ACM as **One or more domain names have failed validation due to a Certification Authority Authorization (CAA) error**. Check with the [CAA checker](https://ssl.sh/tools/caa-checker/). ## Wildcards and custom certificates Amplify supports wildcard subdomains on custom domains. In **Hosting > Custom domains > Domain configuration**, add a subdomain named `*` and map it to a branch; requests for `dev.example.com` or `prod.example.com` then reach that branch. The asterisk must be the whole label: `*domain.example.com` and `subdomain.*.example.com` are not allowed. By default all Amplify provisioned certificates cover all subdomains of the custom domain. To use your own certificate: 1. Obtain it from any CA. Amplify supports RSA keys of 1024, 2048, 3072 or 4096 bits and ECDSA P-256 (`prime256v1`) keys. 2. Import it into ACM, or request it there, in the US East (N. Virginia) `us-east-1` Region. 3. Make sure it covers every subdomain you will add; a `*.example.com` name helps. 4. Select it as **Custom SSL certificate** when adding or updating the domain. ACM does not renew imported certificates. Renew at your CA, re-import into ACM, and Amplify refreshes the certificate data for the domain. You can switch between managed and custom certificates at any time. ## Verify A managed certificate shows an Amazon issuer and covers the root and each subdomain you added. Check it with the [SSL checker](https://ssl.sh/tools/ssl-checker/), or: ```bash curl ssl.sh/example.com ``` Then confirm what CloudFront serves for your name: ```bash openssl s_client -connect example.com:443 -servername example.com /dev/null \ | openssl x509 -noout -issuer -subject -ext subjectAltName -dates ``` Do not test the bare `cloudfront.net` URL: it returns 404 because Amplify routes by hostname. ## Renewal The managed certificate renews automatically as long as the app is hosted on Amplify and the validation CNAME is untouched. Amplify's pages still describe a 13-month certificate, but the ACM documentation now says ACM certificates are valid for 198 days, which fits the 200-day maximum that applies since March 15, 2026 under CA/Browser Forum ballot SC-081v3. The maximum drops to 100 days on March 15, 2027 and 47 days on March 15, 2029. Imported certificates are your responsibility, so put them in [ssl.sh monitoring](https://ssl.sh/monitor/) (in development). ## Troubleshooting - **Pending Verification (third-party DNS)**: confirm the CNAMEs resolve with `dig` or whatsmydns.net. If they exist and still do not resolve, ask the DNS provider or move DNS to Route 53. - **Pending Verification (Route 53)**: the registered domain's name servers differ from the hosted zone's; make them match. - **Pending Verification (multi-level subdomains)**: your provider may have appended the domain twice. Try the record name without the SLD and TLD, e.g. `_hash.docs.backend` instead of `_hash.docs.backend.example.com`, and wait 15 to 30 minutes. - **CNAMEAlreadyExistsException**: the hostname is attached to another CloudFront distribution, in this or another account. Remove it there, wait at least an hour if it was deleted recently, then reconnect. - **Additional Verification Required**: ACM needs more information, for example for popular domains; contact AWS Support. - **The requested domain cannot be used by this AWS account. Please contact AWS support for assistance.**: a cross-account association. Include a subdomain such as `www` so Amplify can verify ownership automatically, or add the `_amplify-cross-account-ownership-proof` TXT record and contact Support. - **SSL certificate or HTTPS errors** after you added CAA: ACM cannot update or reissue the certificate. Add an Amazon CAA value, then delete and reconnect the domain (this causes downtime) or ask Support to reissue. See [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/).