We encourage the use of AWS Certificate Manager (ACM) to create certificates for use by AWS services.
As of , Cornell no longer supports email-based validation of certificates in the cornell.edu domain, or in other domains served by Cornell DNS database. Instead, DNS-based validation should be used for ACM certificates.
See references below for more details.
There is a wrinkle in ACM certificate validation and renewal that isn't obvious:
If the domain for your certificate has CAA records for some other certificate provider (e.g., letsencrypt.org), then you will need to add a CAA record to the domain for amazon.com. The value of the CAA record should be 0 issue "amazon.com". You will also need to create the CNAME record in the domain as directed by ACM. If there is no CAA record for amazon.com but there is a CAA record for some other domain, the ACM certificate validation or renewal process will fail without any messaging about why it is failing.
If there are no CAA records present in the domain for your certificate, then creating CNAME records as directed by ACM will be sufficient for certificate validation and renewal.