{"record":{"id":"e66bc00af69166c7","repo":"anomalyco/sst","slug":"need-to-provide-a-validated-certificate-via-cert","errorCode":null,"errorMessage":"Need to provide a validated certificate via \"cert\" when DNS is disabled","messagePattern":"Need to provide a validated certificate via \"cert\" when DNS is disabled","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/app-sync.ts","lineNumber":530,"sourceCode":"    createDnsRecords();\n\n    this.constructorName = name;\n    this.constructorOpts = opts;\n    this.api = api;\n    this.domainName = domainName;\n\n    this.registerOutputs({ _hint: this.url });\n\n    function normalizeDomain() {\n      if (!args.domain) return;\n\n      // validate\n      output(args.domain).apply((domain) => {\n        if (typeof domain === \"string\") return;\n\n        if (!domain.name) throw new Error(`Missing \"name\" for domain.`);\n        if (domain.dns === false && !domain.cert)\n          throw new Error(\n            `Need to provide a validated certificate via \"cert\" when DNS is disabled`,\n          );\n      });\n\n      // normalize\n      return output(args.domain).apply((domain) => {\n        const norm = typeof domain === \"string\" ? { name: domain } : domain;\n\n        return {\n          name: norm.name,\n          dns: norm.dns === false ? undefined : norm.dns ?? awsDns(),\n          cert: norm.cert,\n        };\n      });\n    }\n\n    function loadSchema() {\n      return output(args.schema).apply(async (schema) =>","sourceCodeStart":512,"sourceCodeEnd":548,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/app-sync.ts#L512-L548","documentation":"When you explicitly set `dns: false` in the AppSync domain config, SST will not create/validate the ACM certificate or DNS records for you, so it requires you to supply an already-validated ACM certificate ARN via `cert`. This prevents deploying a custom domain that has no usable TLS certificate.","triggerScenarios":"Passing `domain: { name: \"api.example.com\", dns: false }` without a `cert` property to an AppSync component.","commonSituations":"Disabling DNS management because the zone is hosted elsewhere (e.g. Cloudflare or an external registrar) but forgetting that a validated ACM cert in the same region must then be provided manually.","solutions":["Provide an ARN of a validated ACM certificate: `domain: { name: \"api.example.com\", dns: false, cert: \"arn:aws:acm:us-east-1:...\" }`","Or set `dns: true` (or remove `dns: false`) and let SST create and validate the certificate via the hosted zone","If the zone is external, request/validate an ACM cert manually (DNS or email validation) and then pass its ARN"],"exampleFix":"// before\ndomain: { name: \"api.example.com\", dns: false }\n// after\ndomain: { name: \"api.example.com\", dns: false, cert: \"arn:aws:acm:us-east-1:123456789012:certificate/abc-123\" }","handlingStrategy":"validation","validationCode":"function validateDomainCert(domain) {\n  if (typeof domain === \"object\" && domain?.dns === false && !domain.cert)\n    throw new Error('domain.dns === false requires a validated ACM cert ARN in \"cert\"');\n}\nvalidateDomainCert(args.domain);","typeGuard":"function hasValidatedCert(d) {\n  return d.dns !== false || typeof d.cert === \"string\" && d.cert.startsWith(\"arn:aws:acm:\");\n}","tryCatchPattern":"null","preventionTips":["Only set dns:false when the zone is managed externally; provide the ACM cert ARN in the same commit","Ensure the ACM cert is validated and in the correct region before referencing it","Default to dns:true and let SST provision/validate the certificate automatically"],"tags":["appsync","acm","certificate","dns","config-validation"],"backgroundTag":"missing-acm-certificate","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}