anomalyco/sst · error · Error

Need to provide a validated certificate via "cert" when DNS

Error message

Need to provide a validated certificate via "cert" when DNS is disabled

What it means

When you explicitly set `dns: false` in the AppSync domain config, SST will not create/validate the ACM certificate or DNS records for you, so it requires you to supply an already-validated ACM certificate ARN via `cert`. This prevents deploying a custom domain that has no usable TLS certificate.

Source

Thrown at platform/src/components/aws/app-sync.ts:530

    createDnsRecords();

    this.constructorName = name;
    this.constructorOpts = opts;
    this.api = api;
    this.domainName = domainName;

    this.registerOutputs({ _hint: this.url });

    function normalizeDomain() {
      if (!args.domain) return;

      // validate
      output(args.domain).apply((domain) => {
        if (typeof domain === "string") return;

        if (!domain.name) throw new Error(`Missing "name" for domain.`);
        if (domain.dns === false && !domain.cert)
          throw new Error(
            `Need to provide a validated certificate via "cert" when DNS is disabled`,
          );
      });

      // normalize
      return output(args.domain).apply((domain) => {
        const norm = typeof domain === "string" ? { name: domain } : domain;

        return {
          name: norm.name,
          dns: norm.dns === false ? undefined : norm.dns ?? awsDns(),
          cert: norm.cert,
        };
      });
    }

    function loadSchema() {
      return output(args.schema).apply(async (schema) =>

View on GitHub (pinned to a0bd20f762)

Solutions

Provide an ARN of a validated ACM certificate: `domain: { name: "api.example.com", dns: false, cert: "arn:aws:acm:us-east-1:..." }`
Or set `dns: true` (or remove `dns: false`) and let SST create and validate the certificate via the hosted zone
If the zone is external, request/validate an ACM cert manually (DNS or email validation) and then pass its ARN

Example fix

// before
domain: { name: "api.example.com", dns: false }
// after
domain: { name: "api.example.com", dns: false, cert: "arn:aws:acm:us-east-1:123456789012:certificate/abc-123" }

Defensive patterns

Strategy: validation

Validate before calling

function validateDomainCert(domain) {
  if (typeof domain === "object" && domain?.dns === false && !domain.cert)
    throw new Error('domain.dns === false requires a validated ACM cert ARN in "cert"');
}
validateDomainCert(args.domain);

Type guard

function hasValidatedCert(d) {
  return d.dns !== false || typeof d.cert === "string" && d.cert.startsWith("arn:aws:acm:");
}

Try / catch

null

Prevention

Only set dns:false when the zone is managed externally; provide the ACM cert ARN in the same commit
Ensure the ACM cert is validated and in the correct region before referencing it
Default to dns:true and let SST provision/validate the certificate automatically

When it happens

Trigger: Passing `domain: { name: "api.example.com", dns: false }` without a `cert` property to an AppSync component.

Common situations: Disabling DNS management because the zone is hosted elsewhere (e.g. Cloudflare or an external registrar) but forgetting that a validated ACM cert in the same region must then be provided manually.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/e66bc00af69166c7. Report an issue: GitHub.