Back to notes
• 3 min read

SSL Certificate with CloudFormation

You bought a domain in Route 53. AWS already created a hosted zone for you. Now you need an SSL certificate. Here’s the entire CloudFormation stack.

Parameters

Route 53 handles two separate things: domain registration and DNS hosting. Registering a domain creates a hosted zone automatically, but they’re independent resources. The hosted zone has an ID. You pass it into your stack as a parameter so CloudFormation knows where to write DNS records.

AWSTemplateFormatVersion: '2010-09-09'
Description: ACM certificate for a domain with DNS validation via Route 53.

Parameters:
  HostedZoneId:
    Type: String
    Description: The ID of the hosted zone created by AWS when the domain was purchased.

Find yours in the AWS console: Route 53 > Hosted zones > your domain > Hosted zone details. The ID is listed there.

Resources

The only resource here is an AWS::CertificateManager::Certificate. ACM issues free, auto-renewing certificates for domains you can prove you own.

Resources:
  SiteCertificate:
    Type: 'AWS::CertificateManager::Certificate'
    Properties:
      DomainName: example.net
      SubjectAlternativeNames:
        - '*.example.net'
      ValidationMethod: DNS
      DomainValidationOptions:
        - DomainName: example.net
          HostedZoneId: !Ref HostedZoneId

A few things to note:

  • DomainName is your apex domain (example.net).
  • SubjectAlternativeNames adds the wildcard (*.example.net). A wildcard cert alone does not cover the apex, so you need both.
  • ValidationMethod: DNS tells ACM to prove ownership through a DNS record instead of email. Fully automatic.
  • DomainValidationOptions tells CloudFormation which hosted zone to write each validation CNAME into. List only the apex: ACM uses one identical record for a domain and its own wildcard, so example.net’s entry validates *.example.net too. List both and CloudFormation writes the same record twice, which Route 53 rejects and the stack fails. Add more entries only for SANs that validate to a different record, like a separate domain.

Outputs

Export the certificate ARN so other stacks can reference it with !ImportValue.

Outputs:
  ExampleCertificateArn:
    Value: !Ref SiteCertificate
    Export:
      Name: Example-CertificateArn

The site stacks import Example-CertificateArn for the CloudFront distribution’s ViewerCertificate.

The full CloudFormation template is in the repo linked below.