AWS ACM Troubleshooting

AWS ACM certificate issues are frustrating because they're often silent failures. This guide helps you diagnose and fix the most common problems fast. For the full deep dive on ACM, see the AWS ACM Complete Guide.

Certificate Stuck on "Pending Validation"

This is the #1 ACM issue. Run these four checks in order:

# Replace with your actual validation string from ACM console
dig _abc123xyz.yourdomain.com CNAME +short

# Find where your DNS is actually hosted
dig yourdomain.com NS +short

dig yourdomain.com CAA +short

Validation Timed Out (72 Hours)

What to do:

1. 1Delete the failed certificate request
2. 2Fix the underlying issue (use the checks above)
3. 3Request a new certificate

# Delete failed certificate
aws acm delete-certificate \
  --certificate-arn arn:aws:acm:us-east-1:123456789:certificate/failed-cert-id \
  --region us-east-1

# Request new certificate
aws acm request-certificate \
  --domain-name yourdomain.com \
  --validation-method DNS \
  --region us-east-1

CloudFront Can't Find My Certificate

Diagnose:

# Check if certificate exists in us-east-1
aws acm list-certificates --region us-east-1

# If your cert isn't listed, check where it actually is:
aws acm list-certificates --region eu-west-1  # or wherever you created it

Fix:

# Request certificate in the correct region
aws acm request-certificate \
  --domain-name yourdomain.com \
  --subject-alternative-names "*.yourdomain.com" \
  --validation-method DNS \
  --region us-east-1  # Required for CloudFront!

Certificate Won't Renew

Check Renewal Status:

aws acm describe-certificate \
  --certificate-arn arn:aws:acm:... \
  --query 'Certificate.RenewalSummary'

Can't Delete Certificate

ACM won't let you delete a certificate that's currently attached to an AWS resource.

Find what's using it:

aws acm describe-certificate \
  --certificate-arn arn:aws:acm:us-east-1:123456789:certificate/abc-123 \
  --query 'Certificate.InUseBy'

Common culprits:

• Application Load Balancer (ALB)
• CloudFront Distribution
• API Gateway
• Elastic Beanstalk
• Network Load Balancer (NLB)
• App Runner

CAA Error Blocking Issuance

CAA (Certificate Authority Authorization) records tell CAs who's allowed to issue certificates for your domain. If you have CAA records but Amazon isn't listed, ACM can't issue certificates.

Diagnose:

dig yourdomain.com CAA +short

Fix:

Add this CAA record to your DNS:

yourdomain.com.  CAA  0 issue "amazon.com"

Quick Diagnostic Commands

# Check if CNAME validation record exists
dig _[validation-string].yourdomain.com CNAME +short

# Check CAA records
dig yourdomain.com CAA +short

# Check where DNS is hosted
dig yourdomain.com NS +short

# List all certs in us-east-1 (for CloudFront)
aws acm list-certificates --region us-east-1

# Get certificate details including what's using it
aws acm describe-certificate \
  --certificate-arn [ARN] \
  --region [REGION]

# Check certificate status
aws acm describe-certificate \
  --certificate-arn [ARN] \
  --query 'Certificate.Status'

# Check renewal status
aws acm describe-certificate \
  --certificate-arn [ARN] \
  --query 'Certificate.RenewalSummary'

# Find what's using a certificate
aws acm describe-certificate \
  --certificate-arn [ARN] \
  --query 'Certificate.InUseBy'

# Delete a certificate (must not be in use)
aws acm delete-certificate \
  --certificate-arn [ARN] \
  --region [REGION]

Still Stuck?

• AWS Service Health Dashboard

  Check if ACM is experiencing issues in your region

• Open an AWS Support ticket

  For persistent issues, AWS Support can check ACM internals you can't see

• Try a different subdomain

  If validation keeps failing for www.example.com, try example.com with *.example.com as a SAN

Frequently Asked Questions