Back to notes
• 3 min read

SSL Certificate with CloudFormation

You bought a domain in Route 53. AWS already created a hosted zone for you. Now you need an SSL certificate. Here’s the entire CloudFormation stack.

Parameters

Route 53 handles two separate things: domain registration and DNS hosting. Registering a domain creates a hosted zone automatically, but they’re independent resources. The hosted zone has an ID. You pass it into your stack as a parameter so CloudFormation knows where to write DNS records.

Parameters:
  HostedZoneId:
    Type: String
    Description: The ID of the hosted zone created by AWS when the domain was purchased.

Find yours in the AWS console: Route 53 > Hosted zones > your domain > Hosted zone details. The ID is listed there.

Resources

The only resource here is an AWS::CertificateManager::Certificate. ACM issues free, auto-renewing certificates for domains you can prove you own.

Resources:
  ExampleCardCertificate:
    Type: 'AWS::CertificateManager::Certificate'
    Properties:
      DomainName: example.net
      SubjectAlternativeNames:
        - '*.example.net'
      ValidationMethod: DNS
      DomainValidationOptions:
        - DomainName: example.net
          HostedZoneId: !Ref HostedZoneId
        - DomainName: '*.example.net'
          HostedZoneId: !Ref HostedZoneId

A few things to note:

  • DomainName is your apex domain (example.net).
  • SubjectAlternativeNames adds the wildcard (*.example.net). A wildcard cert alone does not cover the apex, so you need both.
  • ValidationMethod: DNS tells ACM to prove ownership through a DNS record instead of email. Fully automatic.
  • DomainValidationOptions maps each domain to the hosted zone where its validation CNAME should be created. You need one entry per domain, both the apex and the wildcard. If you only map the apex, CloudFormation will hang waiting for the wildcard’s DNS record that never gets created.

Outputs

Export the certificate ARN so other stacks can reference it with !ImportValue.

Outputs:
  ExampleCertificateArn:
    Value: !Ref ExampleCardCertificate
    Export:
      Name: Example-CertificateArn

The site stacks import Example-CertificateArn for the CloudFront distribution’s ViewerCertificate.

The full CloudFormation template is in the repo linked below.

Next up: the IAM role and Git Sync setup that deploy this stack to AWS.