anomalyco/sst · error · Error

Need to provide a validated certificate via "cert" when DNS

Error message

Need to provide a validated certificate via "cert" when DNS is disabled

What it means

HttpsRedirect can either create DNS records and a certificate automatically (dns enabled) or rely on a user-supplied, already-validated certificate. validateArgs throws when dns is disabled but no cert argument is provided, because the distribution then has no way to serve HTTPS.

Source

Thrown at platform/src/components/aws/https-redirect.ts:62

  constructor(
    name: string,
    args: HttpsRedirectArgs,
    opts?: ComponentResourceOptions,
  ) {
    super(__pulumiType, name, args, opts);

    const parent = this;

    validateArgs();
    const certificateArn = createSsl();
    const bucket = createBucket();
    const bucketWebsite = createBucketWebsite();
    const distribution = createDistribution();
    createDnsRecords();

    function validateArgs() {
      if (!args.dns && !args.cert)
        throw new Error(
          `Need to provide a validated certificate via "cert" when DNS is disabled`,
        );
    }

    function createSsl() {
      if (args.cert) return args.cert;

      return new DnsValidatedCertificate(
        `${name}Ssl`,
        {
          domainName: output(args.sourceDomains).apply((domains) => domains[0]),
          alternativeNames: output(args.sourceDomains).apply((domains) =>
            domains.slice(1),
          ),
          dns: args.dns!,
        },
        { parent, provider: useProvider("us-east-1") },
      ).arn;

View on GitHub (pinned to a0bd20f762)

Solutions

1. Provide a validated ACM certificate (in us-east-1) via the cert option
2. Enable DNS management (remove dns:false) so SST can create and validate the cert automatically
3. Validate the ACM cert in us-east-1 first, then pass its ARN

Example fix

// before
new sst.aws.HttpsRedirect("Redirect", { targetDomain: "x.com", dns: false })
// after
new sst.aws.HttpsRedirect("Redirect", { targetDomain: "x.com", dns: false, cert: "arn:aws:acm:us-east-1:123:certificate/abc" })

function assertHttpsRedirectArgs(args: { dns?: boolean; cert?: string }) {
  if (args.dns === false && !args.cert)
    throw new Error("cert required when dns is disabled");
}

const hasValidCert = (a: { dns?: boolean; cert?: string }): a is { dns?: false; cert: string } =>
  a.dns !== false || typeof a.cert === "string";

try { new sst.aws.HttpsRedirect("R", args); } catch (e) { /* fall back to dns:true or prompt for cert ARN */ }

When it happens

Trigger: Creating new sst.aws.HttpsRedirect with { dns: false } (or a non-AWS DNS provider) and omitting the cert property.

Common situations: Using Cloudflare/external DNS where ACM DNS validation records cannot be auto-created; migrating configs and dropping the cert field; assuming the component would fall back to HTTP.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Need to provide a validated certificate via "cert" when DNS
• Need to provide a validated certificate via "cert" when DNS
• Need to provide a validated certificate via "cert" when DNS
• The DNS record "${partial.name}" cannot be created because t
• Lambda@Edge functions must be deployed in us-east-1 region.

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/3562a839877b2f7f. Report an issue: GitHub.