{"record":{"id":"ac7cb08ff34c2e92","repo":"anomalyco/sst","slug":"need-to-provide-a-validated-certificate-via-cert-ac7cb0","errorCode":null,"errorMessage":"Need to provide a validated certificate via \"cert\" when DNS is disabled.","messagePattern":"Need to provide a validated certificate via \"cert\" when DNS is disabled\\.","errorType":"exception","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/cognito-user-pool.ts","lineNumber":830,"sourceCode":"    }\n\n    function normalizeDomain() {\n      if (!args.domain) return;\n\n      return output(args.domain).apply((domain) => {\n        if (typeof domain === \"string\") domain = { name: domain };\n\n        if (\"prefix\" in domain) {\n          return {\n            prefix: domain.prefix,\n            name: undefined,\n            dns: undefined,\n            cert: undefined,\n          };\n        }\n\n        if (domain.dns === false && !domain.cert) {\n          throw new VisibleError(\n            `Need to provide a validated certificate via \"cert\" when DNS is disabled.`,\n          );\n        }\n\n        return {\n          prefix: undefined,\n          name: domain.name,\n          dns: domain.dns === false ? undefined : (domain.dns ?? awsDns()),\n          cert: domain.cert,\n        };\n      });\n    }\n\n    function createSsl() {\n      if (!domain) return output(undefined);\n\n      return domain.apply((domain) => {\n        if (domain.prefix) return output(undefined);","sourceCodeStart":812,"sourceCodeEnd":848,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/cognito-user-pool.ts#L812-L848","documentation":"A Cognito user pool custom domain requires a validated ACM certificate in us-east-1. When dns is false SST will not create validation records via Route53, so you must supply an already-validated certificate ARN via domain.cert.","triggerScenarios":"new sst.aws.CognitoUserPool('X', { domain: { name: 'auth.example.com', dns: false } }) without cert — normalizeDomain throws when domain.dns === false && !domain.cert.","commonSituations":"Hosting DNS outside Route53 (Cloudflare, Vercel DNS) while adding a custom Cognito domain; disabling dns in copied config; cert created in the wrong region (must be us-east-1 for Cognito).","solutions":["Pass an already-validated ACM certificate ARN in us-east-1 via domain.cert.","Or set dns: true (default) so SST requests and validates the ACM cert through its Route53 zone.","If the cert exists but isn't validated, complete the DNS validation in your DNS provider first.","Confirm the cert ARN region is us-east-1 — Cognito custom domains reject certs from other regions."],"exampleFix":"// before\ndomain: { name: 'auth.example.com', dns: false }\n// after\ndomain: { name: 'auth.example.com', dns: false, cert: 'arn:aws:acm:us-east-1:123456789012:certificate/abc-123' }","handlingStrategy":"validation","validationCode":"function validateCognitoDomain(domain) {\n  const d = typeof domain === 'string' ? { name: domain } : domain;\n  if (d?.dns === false && !d.cert)\n    throw new Error('Provide a validated us-east-1 ACM cert via domain.cert when dns is false');\n}\nvalidateCognitoDomain({ name: 'auth.example.com', dns: false, cert: CERT_ARN });","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep a validated us-east-1 ACM cert ARN in config for external-DNS setups.","Let SST manage DNS (dns: true) unless external DNS is a hard requirement.","Confirm the cert status is ISSUED before deploying the pool domain."],"tags":["aws","cognito","acm","dns","config-validation"],"backgroundTag":"missing-validated-certificate","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}