DnsValidatedCertificate doesn't support validationDomains

[jimfum]

https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-certificatemanager.DnsValidatedCertificate.html

Issue: The docs offers optional validationDomains prop which suggests you can create one certificate for e.g. click.mydomain.com and click.mydomain.co.uk (through subjectAlternativeNames) and specify the parent domains for both where the domain validation happens. However, at the same time there's a mandatory prop hostedZone - one zone in which the validation record is created (i.e. cannot be both mydomain.com and mydomain.co.uk).

---

This is a 📕 documentation issue

[moatazelmasry2]

Nop I think this is a misunderstanding on your side. Both in cdk and not cdk (cloudformation, api, ui) etc.. you can provide alternative names only for the same domain. So you create a certificate for

• www.example.com
• example.com
• bla.example.com
• *.example.com

And it doesn't really matter, which one is the main domain name and which are the alternative names, most important they all belong to the same domain name (i.e. same hosted zone).

[jimfum]

Getting confused here. Through the console I've created a single certificate for link.company.com with alternative names link.company.co.uk and link.company.ie. I've validated the individual domains by manually adding verification entries to zones company.com, company.co.uk and company.ie. The certifikace was validated and was usable in CloudFront.
The same is doable with https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-certificatemanager.Certificate.html by providing validationDomains map with the above information (e.g. { "link.company.com":"company.com", "link.company.co.uk":"company.co.uk"... }) and then adding the generated verification CNAMEs to the domains.

[moatazelmasry2]

Hmm my bad then. I always thought this is not possible at least in cfn. Need to verify. Otherwise you probably have found then a missing feature in cdk

[jimfum]

Thanks. There was a fix to make DnsValidatedCertificate working with your scenario a while back I noticed but my use case isn't covered. The Certificate construct can do it (without the validation part obviously) while DnsValidatedCertificate cannot even though it gives impression it can based on the similar documentation as Certificate.

[skinny85]

Hi @jimfum ,

thanks for opening the issue, but DnsValidatedCertificate does support the validationDomains property: https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-certificatemanager.DnsValidatedCertificate.html#validationdomains-span-class-api-icon-api-icon-experimental-title-this-api-element-is-experimental-it-may-change-without-notice-span

Are you saying it doesn't work somehow for your use case?

Thanks,
Adam

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[jimfum]

Hi @skinny85,

That is right. It didn't work for my use case which is a certificate for a.company.com with alternative names like a.company.co.uk and a,company.ca. One would expect the domain ownership verification records to be created in all three domains but that didn't happen (only in the first .com one did) making the certificate to be never validated. The documentation, by mentioning validationDomains property, gives an impression it's possible but I haven't managed. It's confusing as there's the hostedZone property which is where the domain validation record is created for the main domain (.com) but for the others CDK doesn't ask for their hostedZones so does it try to infer them from validationDomains strings?

Thanks,
Jim

[skinny85]

Hey @jimfum ,

could your problems be possibly related to #7995 ?

Thanks,
Adam

[njlynch]

Hi @jimfum ,

You're correct that the DnsValidatedCertificate's validationDomains property doesn't work for multi-zone DNS validation; it's there for email-based validation.

Native CloudFormation support for DNS validation was just added to the CDK via #8552. There is an example usage of it here; this should be included in the next release. The DnsValidatedCertificate class will remain, but I recommend migrating to the above once released, unless you need cross-region support (requesting a certificate in a different region than the current stack is in). Would this solve your use case?

[jimfum]

Hi @njlynch,

This looks like exactly what I'm after. Is it realistic to expect release 1.52 will contain that?

Thanks a lot

[njlynch]

Is it realistic to expect release 1.52 will contain that?

Yes, the above should be included in the next release (1.52).

[jimfum]

@njlynch, 1.52 is out and Certificate does what I need. A small thing, when destroying, the DNS validation entries aren't removed.