anomalyco/sst · error · Error

Need to provide a validated certificate via "cert" when DNS

Error message

Need to provide a validated certificate via "cert" when DNS is disabled

What it means

SST's Cdn (CloudFront) component can provision and validate an ACM certificate automatically only when it manages DNS. When you set domain.dns to false, SST cannot create the DNS validation records, so it refuses to proceed unless you supply an already-validated ACM certificate via domain.cert.

Source

Thrown at platform/src/components/aws/cdn.ts:344

        `${name}Distribution`,
        ref.distributionID,
        undefined,
        { parent },
      );

      return { distribution };
    }

    function normalizeDomain() {
      if (!args.domain) return;

      return output(args.domain).apply((domain) => {
        const norm = typeof domain === "string" ? { name: domain } : domain;

        // validate
        if (!norm.name) throw new Error(`Missing "name" for domain.`);
        if (norm.dns === false && !norm.cert)
          throw new Error(
            `Need to provide a validated certificate via "cert" when DNS is disabled`,
          );

        return {
          name: norm.name,
          aliases: norm.aliases ?? [],
          redirects: norm.redirects ?? [],
          dns: norm.dns === false ? undefined : norm.dns ?? awsDns(),
          cert: norm.cert,
        };
      });
    }

    function createSsl() {
      if (!domain) return output(undefined);

      return domain.cert.apply((cert) => {
        if (cert) return domain.cert;

View on GitHub (pinned to a0bd20f762)

Solutions

Import your existing validated ACM certificate ARN via domain.cert: { domain: { name: 'example.com', dns: false, cert: 'arn:aws:acm:us-east-1:...' } }.
If you don't have a validated cert, set dns: true (default) so SST can request and validate a new ACM certificate via Route53.
Validate the ACM certificate in another stack/app first, then reference its ARN here.

Example fix

// before
new sst.aws.Cdn('MyCdn', {
  domain: { name: 'cdn.example.com', dns: false }
});
// after
new sst.aws.Cdn('MyCdn', {
  domain: { name: 'cdn.example.com', dns: false, cert: 'arn:aws:acm:us-east-1:123456789012:certificate/abc-123' }
});

Defensive patterns

Strategy: validation

Validate before calling

function validateCdnDomain(domain) {
  const d = typeof domain === 'string' ? { name: domain } : domain;
  if (d?.dns === false && !d.cert)
    throw new Error('dns:false requires a validated ACM cert ARN in domain.cert');
}
validateCdnDomain({ name: 'cdn.example.com', dns: false, cert: process.env.CDN_CERT_ARN });

Prevention

Store the ACM cert ARN in an env/config value and always pass it when dns is false.
Default to dns: true unless you have a specific external-DNS reason.
Validate the cert is in us-east-1 and status ISSUED before referencing it.

When it happens

Trigger: Calling new sst.aws.Cdn(...) with a domain arg where dns: false and cert is undefined (e.g. { domain: { name: 'example.com', dns: false } }). normalizeDomain throws during component construction.

Common situations: Teams using DNS hosted outside the SST app's route53 zone (external DNS, Cloudflare) who disable sst DNS but forget to import an existing validated ACM cert; copying a config with dns: false from a template without adding cert.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/2d8fae04cba07a73. Report an issue: GitHub.