{"record":{"id":"3562a839877b2f7f","repo":"anomalyco/sst","slug":"need-to-provide-a-validated-certificate-via-cert-3562a8","errorCode":null,"errorMessage":"Need to provide a validated certificate via \"cert\" when DNS is disabled","messagePattern":"Need to provide a validated certificate via \"cert\" when DNS is disabled","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/https-redirect.ts","lineNumber":62,"sourceCode":"  constructor(\n    name: string,\n    args: HttpsRedirectArgs,\n    opts?: ComponentResourceOptions,\n  ) {\n    super(__pulumiType, name, args, opts);\n\n    const parent = this;\n\n    validateArgs();\n    const certificateArn = createSsl();\n    const bucket = createBucket();\n    const bucketWebsite = createBucketWebsite();\n    const distribution = createDistribution();\n    createDnsRecords();\n\n    function validateArgs() {\n      if (!args.dns && !args.cert)\n        throw new Error(\n          `Need to provide a validated certificate via \"cert\" when DNS is disabled`,\n        );\n    }\n\n    function createSsl() {\n      if (args.cert) return args.cert;\n\n      return new DnsValidatedCertificate(\n        `${name}Ssl`,\n        {\n          domainName: output(args.sourceDomains).apply((domains) => domains[0]),\n          alternativeNames: output(args.sourceDomains).apply((domains) =>\n            domains.slice(1),\n          ),\n          dns: args.dns!,\n        },\n        { parent, provider: useProvider(\"us-east-1\") },\n      ).arn;","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/https-redirect.ts#L44-L80","documentation":"HttpsRedirect can either create DNS records and a certificate automatically (dns enabled) or rely on a user-supplied, already-validated certificate. validateArgs throws when dns is disabled but no cert argument is provided, because the distribution then has no way to serve HTTPS.","triggerScenarios":"Creating new sst.aws.HttpsRedirect with { dns: false } (or a non-AWS DNS provider) and omitting the cert property.","commonSituations":"Using Cloudflare/external DNS where ACM DNS validation records cannot be auto-created; migrating configs and dropping the cert field; assuming the component would fall back to HTTP.","solutions":["Provide a validated ACM certificate (in us-east-1) via the cert option","Enable DNS management (remove dns:false) so SST can create and validate the cert automatically","Validate the ACM cert in us-east-1 first, then pass its ARN"],"exampleFix":"// before\nnew sst.aws.HttpsRedirect(\"Redirect\", { targetDomain: \"x.com\", dns: false })\n// after\nnew sst.aws.HttpsRedirect(\"Redirect\", { targetDomain: \"x.com\", dns: false, cert: \"arn:aws:acm:us-east-1:123:certificate/abc\" })","handlingStrategy":"validation","validationCode":"function assertHttpsRedirectArgs(args: { dns?: boolean; cert?: string }) {\n  if (args.dns === false && !args.cert)\n    throw new Error(\"cert required when dns is disabled\");\n}","typeGuard":"const hasValidCert = (a: { dns?: boolean; cert?: string }): a is { dns?: false; cert: string } =>\n  a.dns !== false || typeof a.cert === \"string\";","tryCatchPattern":"try { new sst.aws.HttpsRedirect(\"R\", args); } catch (e) { /* fall back to dns:true or prompt for cert ARN */ }","preventionTips":["Always pass cert when using external DNS","Validate ACM cert exists in us-east-1 before deploy","Prefer dns:true unless external DNS is required"],"tags":["acm","dns","cloudfront","https"],"backgroundTag":"missing-certificate-argument","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}