Important Prerequisite: us-east-1 Region for CloudFront
AWS CloudFront requires all custom SSL certificates to be created in the us-east-1 (N. Virginia) region, regardless of where your S3 buckets or EC2 instances are physically hosted.
Step-by-Step AWS ACM Setup
- Open AWS Certificate Manager (ACM) in the
us-east-1region. - Click Request a public certificate.
- Add your domain names:
example.comand*.example.com. - Select DNS validation (recommended for automatic auto-renewals).
- Click Create records in Route 53 to automatically insert the CNAME challenge verification records.
- Attach the issued certificate to your CloudFront distribution under Custom SSL certificate.
⚡ Check If Your CloudFront Certificate Is Active
Verify that your custom domain is serving the AWS ACM certificate properly.
Check AWS SSL Status →