Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

ACME domain validation

ACME domain validation resources pre-authorize which domains an ACME endpoint can issue certificates for. Unlike standard ACM domain validation (which you set up as part of a certificate request), ACME domain validations are persistent resources that the PKI administrator configures in advance. This separation enables application owners to request certificates without having to perform domain validation themselves.

Each domain validation requires a CNAME record in DNS. This is the same type of CNAME record used for standard ACM DNS validation. However, ACME domain validations are specific to individual endpoints. Different endpoints require separate CNAME records, even for the same domain.

How ACME domain validation relates to standard ACM validation

Both mechanisms use the same CNAME record format and purpose: proving domain ownership by placing a specific record in DNS, as described in Amazon Certificate Manager DNS validation. In both cases, the CNAME delegates ongoing domain validation to ACM. Because the record points to a target that ACM manages, ACM can re-validate domain ownership over time without further action from you. This is what lets ACM renew certificates automatically. The following list describes the key differences:

Domain validation scope

When you create a domain validation, you configure a scope that controls what certificates can be issued using this validation. The scope has three independent settings. For definitions of apex domain and subdomain, see Domain Names.

You can combine these settings. The following table shows example scope combinations.

Status lifecycle

After you create a domain validation, ACM attempts to verify the CNAME record for up to 72 hours. If the record is not detected within this period, the domain validation transitions to INVALID status. Make sure you provision the CNAME record promptly after creating the domain validation.

An ACME domain validation transitions through the following statuses:

Failure reasons

Creating a domain validation

You can create an ACME domain validation by using the ACM console or the Amazon CLI.

To create a domain validation (console)

To create a domain validation (Amazon CLI)

Run the following command to create an ACME domain validation:

aws acm create-acme-domain-validation \
    --acme-endpoint-arn arn:aws:acm:region:111122223333:acme-endpoint/00000000-0000-0000-0000-000000000000 \
    --domain-name example.com \
    --prevalidation-options '{
        "DnsPrevalidation": {
            "DomainScope": {
                "ExactDomain": "ENABLED",
                "Subdomains": "ENABLED",
                "Wildcards": "DISABLED"
            },
            "HostedZoneId": "Z1234567890"
        }
    }'

To check the status and get CNAME details, run the following command:

aws acm describe-acme-domain-validation \
    --acme-domain-validation-arn arn:aws:acm:region:111122223333:acme-endpoint/00000000-0000-0000-0000-000000000000/acme-domain-validation/11111111-1111-1111-1111-111111111111

Managing domain validations

You can perform the following management operations on ACME domain validations: