anomalyco/sst · error · VisibleError

Need to provide a validated certificate via "cert" when DNS

Error message

Need to provide a validated certificate via "cert" when DNS is disabled.

What it means

A Cognito user pool custom domain requires a validated ACM certificate in us-east-1. When dns is false SST will not create validation records via Route53, so you must supply an already-validated certificate ARN via domain.cert.

Source

Thrown at platform/src/components/aws/cognito-user-pool.ts:830

    }

    function normalizeDomain() {
      if (!args.domain) return;

      return output(args.domain).apply((domain) => {
        if (typeof domain === "string") domain = { name: domain };

        if ("prefix" in domain) {
          return {
            prefix: domain.prefix,
            name: undefined,
            dns: undefined,
            cert: undefined,
          };
        }

        if (domain.dns === false && !domain.cert) {
          throw new VisibleError(
            `Need to provide a validated certificate via "cert" when DNS is disabled.`,
          );
        }

        return {
          prefix: undefined,
          name: domain.name,
          dns: domain.dns === false ? undefined : (domain.dns ?? awsDns()),
          cert: domain.cert,
        };
      });
    }

    function createSsl() {
      if (!domain) return output(undefined);

      return domain.apply((domain) => {
        if (domain.prefix) return output(undefined);

View on GitHub (pinned to a0bd20f762)

Solutions

Pass an already-validated ACM certificate ARN in us-east-1 via domain.cert.
Or set dns: true (default) so SST requests and validates the ACM cert through its Route53 zone.
If the cert exists but isn't validated, complete the DNS validation in your DNS provider first.
Confirm the cert ARN region is us-east-1 — Cognito custom domains reject certs from other regions.

Example fix

// before
domain: { name: 'auth.example.com', dns: false }
// after
domain: { name: 'auth.example.com', dns: false, cert: 'arn:aws:acm:us-east-1:123456789012:certificate/abc-123' }

Defensive patterns

Strategy: validation

Validate before calling

function validateCognitoDomain(domain) {
  const d = typeof domain === 'string' ? { name: domain } : domain;
  if (d?.dns === false && !d.cert)
    throw new Error('Provide a validated us-east-1 ACM cert via domain.cert when dns is false');
}
validateCognitoDomain({ name: 'auth.example.com', dns: false, cert: CERT_ARN });

Prevention

Keep a validated us-east-1 ACM cert ARN in config for external-DNS setups.
Let SST manage DNS (dns: true) unless external DNS is a hard requirement.
Confirm the cert status is ISSUED before deploying the pool domain.

When it happens

Trigger: new sst.aws.CognitoUserPool('X', { domain: { name: 'auth.example.com', dns: false } }) without cert — normalizeDomain throws when domain.dns === false && !domain.cert.

Common situations: Hosting DNS outside Route53 (Cloudflare, Vercel DNS) while adding a custom Cognito domain; disabling dns in copied config; cert created in the wrong region (must be us-east-1 for Cognito).

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/ac7cb08ff34c2e92. Report an issue: GitHub.