{"record":{"id":"2d8fae04cba07a73","repo":"anomalyco/sst","slug":"need-to-provide-a-validated-certificate-via-cert-2d8fae","errorCode":null,"errorMessage":"Need to provide a validated certificate via \"cert\" when DNS is disabled","messagePattern":"Need to provide a validated certificate via \"cert\" when DNS is disabled","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/cdn.ts","lineNumber":344,"sourceCode":"        `${name}Distribution`,\n        ref.distributionID,\n        undefined,\n        { parent },\n      );\n\n      return { distribution };\n    }\n\n    function normalizeDomain() {\n      if (!args.domain) return;\n\n      return output(args.domain).apply((domain) => {\n        const norm = typeof domain === \"string\" ? { name: domain } : domain;\n\n        // validate\n        if (!norm.name) throw new Error(`Missing \"name\" for domain.`);\n        if (norm.dns === false && !norm.cert)\n          throw new Error(\n            `Need to provide a validated certificate via \"cert\" when DNS is disabled`,\n          );\n\n        return {\n          name: norm.name,\n          aliases: norm.aliases ?? [],\n          redirects: norm.redirects ?? [],\n          dns: norm.dns === false ? undefined : norm.dns ?? awsDns(),\n          cert: norm.cert,\n        };\n      });\n    }\n\n    function createSsl() {\n      if (!domain) return output(undefined);\n\n      return domain.cert.apply((cert) => {\n        if (cert) return domain.cert;","sourceCodeStart":326,"sourceCodeEnd":362,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/cdn.ts#L326-L362","documentation":"SST's Cdn (CloudFront) component can provision and validate an ACM certificate automatically only when it manages DNS. When you set domain.dns to false, SST cannot create the DNS validation records, so it refuses to proceed unless you supply an already-validated ACM certificate via domain.cert.","triggerScenarios":"Calling new sst.aws.Cdn(...) with a domain arg where dns: false and cert is undefined (e.g. { domain: { name: 'example.com', dns: false } }). normalizeDomain throws during component construction.","commonSituations":"Teams using DNS hosted outside the SST app's route53 zone (external DNS, Cloudflare) who disable sst DNS but forget to import an existing validated ACM cert; copying a config with dns: false from a template without adding cert.","solutions":["Import your existing validated ACM certificate ARN via domain.cert: { domain: { name: 'example.com', dns: false, cert: 'arn:aws:acm:us-east-1:...' } }.","If you don't have a validated cert, set dns: true (default) so SST can request and validate a new ACM certificate via Route53.","Validate the ACM certificate in another stack/app first, then reference its ARN here."],"exampleFix":"// before\nnew sst.aws.Cdn('MyCdn', {\n  domain: { name: 'cdn.example.com', dns: false }\n});\n// after\nnew sst.aws.Cdn('MyCdn', {\n  domain: { name: 'cdn.example.com', dns: false, cert: 'arn:aws:acm:us-east-1:123456789012:certificate/abc-123' }\n});","handlingStrategy":"validation","validationCode":"function validateCdnDomain(domain) {\n  const d = typeof domain === 'string' ? { name: domain } : domain;\n  if (d?.dns === false && !d.cert)\n    throw new Error('dns:false requires a validated ACM cert ARN in domain.cert');\n}\nvalidateCdnDomain({ name: 'cdn.example.com', dns: false, cert: process.env.CDN_CERT_ARN });","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Store the ACM cert ARN in an env/config value and always pass it when dns is false.","Default to dns: true unless you have a specific external-DNS reason.","Validate the cert is in us-east-1 and status ISSUED before referencing it."],"tags":["aws","cloudfront","acm","dns","config-validation"],"backgroundTag":"missing-validated-certificate","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}