Overview

We encourage the use of AWS Certificate Manager (ACM) to create certificates for use by AWS services.

As of , Cornell no longer supports email-based validation of certificates in the cornell.edu domain, or in other domains served by Cornell DNS database. Instead, DNS-based validation should be used for ACM certificates.

See references below for more details.

There is a wrinkle in ACM certificate validation and renewal that isn't obvious:

  • If the domain for your certificate has CAA records for some other certificate provider (e.g., letsencrypt.org), then you will need to add a CAA record to the domain for amazon.com. The value of the CAA record should be 0 issue "amazon.com". You will also need to create the CNAME record in the domain as directed by ACM. If there is no CAA record for amazon.com but there is a CAA record for some other domain, the ACM certificate validation or renewal process will fail without any messaging about why it is failing.
  • If there are no CAA records present in the domain for your certificate, then creating CNAME records as directed by ACM will be sufficient for certificate validation and renewal.

References


  • No labels