Skip to content
Jai
Back to blog
•
2 min read

SSL Certificate with CloudFormation

You bought a domain in Route 53. AWS already created a hosted zone for you. Now you need an SSL certificate. Here’s the entire CloudFormation stack.

Parameters

When you purchase a domain through Route 53, AWS automatically creates a hosted zone. That zone has an ID. You pass it into your stack as a parameter so CloudFormation knows where to write DNS records.

Parameters:
  HostedZoneId:
    Type: String
    Description: The ID of the Hosted Zone created by AWS when the domain was purchased.

Resources

The only resource here is an AWS::CertificateManager::Certificate. ACM issues free, auto-renewing certificates for domains you can prove you own.

Resources:
  ExampleCardCertificate:
    Type: 'AWS::CertificateManager::Certificate'
    Properties:
      DomainName: example.net
      SubjectAlternativeNames:
        - '*.example.net'
      ValidationMethod: DNS
      DomainValidationOptions:
        - DomainName: example.net
          HostedZoneId: !Ref HostedZoneId

A few things to note:

  • DomainName is your apex domain (example.net).
  • SubjectAlternativeNames adds the wildcard (*.example.net). A wildcard cert alone does not cover the apex, so you need both.
  • ValidationMethod: DNS tells ACM to prove ownership through a DNS record instead of email. Fully automatic.
  • DomainValidationOptions with HostedZoneId tells CloudFormation exactly which hosted zone to write the validation CNAME into. No manual steps, the whole thing is hands-off.

Outputs

Export the certificate ARN so other stacks can reference it with !ImportValue.

Outputs:
  WildCardCertificateArn:
    Value: !Ref ExampleCardCertificate
    Export:
      Name: WildCard-CertificateArn