The certificate that is attached to your distribution doesn't cover the alternate domain name (CNAME) that you're trying to add

[kaihendry]

🐛 Bug Report

What is the problem?

Ran into a bunch of issues running https://github.com/aws-samples/aws-cdk-examples/tree/master/typescript/static-site/

Last one being

The certificate that is attached to your distribution doesn't cover the alternate domain name (CNAME) that you're trying to add

Reproduction Steps

cdk deploy -c domain=webconverger.com -c subdomain=talks

Verbose Log

https://s.natalian.org/2019-08-14/cdk.txt

I already have a *.webconverger.com certificate issued arn:aws:acm:us-east-1:407461997746:certificate/5efcc663-6e6c-43b3-bab0-49ad36b27152 so I am a little puzzled why it is:

1. creating a webconverger.com one instead of a talks.webconverger.com one
2. not simply using the existing wildcard certificate

Environment

Archlinux user

[hendry@t480s static-site]$ git describe --always
e8d9b04
[hendry@t480s static-site]$ cdk --version
1.3.0 (build bba9914)

[kaihendry]

Just tried with cdk 1.4.0 (build 175471f), same issue.

[brad-jones]

We are running into the issue too, we had a bunch of stacks deployed with multiple aliases, some of which were not covered by the cert, which we were fine with as these additional names were only used internally.

We then went to push some new stacks using the same pattern and they failed.

Possibly related to https://aws.amazon.com/about-aws/whats-new/2019/04/amazon-cloudfront-enhances-the-security-for-adding-alternate-domain-names-to-a-distribution/

[rhboyd]

There's a few problems with the Typescript static-site example because of breaking changes since the example was created.

1.) It will attempt to create a new ACM Cert instead of loading an existing one.
these lines should be replaced with something like

const certificateArn = acm.Certificate.fromCertificateArn(this, "mycertArn", scope.node.tryGetContext("acmcertArn").certificateArn;

and the Cert will be passed in as a context variable. You could also have ssm resolve it if you don't want to include the cert arn in you context

2.) The current Route53 behavior is wrong. It will create a new HostedZone instead of using the existing one. these lines will create a new Hosted Zone, but you want to re-use an existing one (because you needed to have one in order to get the ACM Cert) so you need to pass in the HostedZone Name and HostedZone Id

      const zone = route53.HostedZone.fromHostedZoneAttributes(this, "myHostedZone", {
          zoneName: "Richard.Com",
          hostedZoneId: "a123456"
      })

[kaihendry]

What happens if you don't want a subdomain?

[rhboyd]

Purchase a TLD? jk. The example would probably need some modification to support that use-case.

[kaihendry]

Ok, I've opened up a feature request at #151 quickly. Thanks!

[davidsteed]

I have this issue too. I want to host a site and redirect www.site.com and site.com to the same site.
This does not appear to be possible
I have a better example of the static site example here.

https://github.com/davidsteed/awscdkstaticsite
Tried several ways of doing this none appear to work.
I was trying to use a redirect bucket. It was working, but now does not and I don't understand why. Then I tried to set a certificate that is valid for *.example.com and example.com and use that on a single distribution. This is possible using the console, but in cdk you do not appear to be able to add *.example.com and example.com to the same certificate

[rhboyd]

Do the SubjectAlternativeNames not work for specifying additional domain names?

…

On Feb 13, 2020, at 3:45 PM, davidsteed ***@***.***> wrote:  I have this issue too. I want to host a site and redirect www.site.com and site.com to the same site. This does not appear to be possible I have a better example of the static site example here. https://github.com/davidsteed/awscdkstaticsite Tried several ways of doing this none appear to work. I was trying to use a redirect bucket. It was working, but now does not and I don't understand why. Then I tried to set a certificate that is valid for *.example.com and example.com and use that on a single distribution. This is possible using the console, but in cdk you do not appear to be able to add *.example.com and example.com to the same certificate — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or unsubscribe.

[kaihendry]

I'm using Terraform now: https://github.com/kaihendry/dabase.com/blob/master/terraform/s3.tf

Not sure why I didn't think of using Terraform before. It's saner than JS/TS and being locked into a single Cloud provider.

[davidsteed]

I have managed to work round the problem. See here:
https://github.com/davidsteed/awscdkstaticsite