All checks
Low
CloudFront distributions should use custom SSL/TLS certificates
Checks that the CloudFront distribution uses a custom SSL/TLS certificate rather than the default *.cloudfront.net one, so viewers reach it on your own domain name with a certificate issued for it. Clearing it takes a domain name, a certificate for it and a DNS record, not one setting.
- service
- CloudFront
- severity
- Low
- scope
- evaluated once per account
How to fix it
- Interrupts service: Point DNS at the distribution only once its status is Deployed with the new name and certificate, or requests for that name fail in between.
- Affects another check: With Legacy clients support off, this also clears CloudFront.8, and CloudFront.15 starts checking the distribution's Security policy.
In the console
CloudFront → Distributions → the distribution → General → Settings → Edit
- Alternate domain name (CNAME)
- A domain name you own or are authorized to use, such as www.example.com
- Custom SSL certificate
- One that covers that name: from ACM in us-east-1, whatever Region you work in, or from the IAM certificate store
- Legacy clients support
- Off, so CloudFront serves HTTPS with SNI; on adds a monthly charge
- DNS record for the alternate domain name
- A CNAME, or a Route 53 alias, to the distribution domain name, such as d111111abcdef8.cloudfront.net
See which of your accounts this check is failing on.
Book a live scan