diff --git a/packages/@aws-cdk/aws-certificatemanager/README.md b/packages/@aws-cdk/aws-certificatemanager/README.md
index bbb16d5b5064c..69889eb494533 100644
--- a/packages/@aws-cdk/aws-certificatemanager/README.md
+++ b/packages/@aws-cdk/aws-certificatemanager/README.md
@@ -17,14 +17,14 @@ zone `example.com` that provides authoritative records for the domain.
 
 ```ts
 import { HostedZoneProvider } from '@aws-cdk/aws-route53';
-import { DNSValidatedCertificate } from '@aws-cdk/aws-certificatemanager';
+import { DnsValidatedCertificate } from '@aws-cdk/aws-certificatemanager';
 
 const hostedZone = new HostedZoneProvider(this, {
     domainName: 'example.com',
     privateZone: false
 }).findAndImport(this, 'ExampleDotCom');
 
-const certificate = new DNSValidatedCertificate(this, 'TestCertificate', {
+const certificate = new DnsValidatedCertificate(this, 'TestCertificate', {
     domainName: 'test.example.com',
     hostedZone: hostedZone
 });
diff --git a/packages/@aws-cdk/aws-certificatemanager/lib/dns-validated-certificate.ts b/packages/@aws-cdk/aws-certificatemanager/lib/dns-validated-certificate.ts
index 18d3e7d34d9ea..2c7d234849f78 100644
--- a/packages/@aws-cdk/aws-certificatemanager/lib/dns-validated-certificate.ts
+++ b/packages/@aws-cdk/aws-certificatemanager/lib/dns-validated-certificate.ts
@@ -6,7 +6,7 @@ import cdk = require('@aws-cdk/cdk');
 import path = require('path');
 import { CertificateImportProps, CertificateProps, ICertificate } from './certificate';
 
-export interface DNSValidatedCertificateProps extends CertificateProps {
+export interface DnsValidatedCertificateProps extends CertificateProps {
     /**
      * Route 53 Hosted Zone used to perform DNS validation of the request.  The zone
      * must be authoritative for the domain name specified in the Certificate Request.
@@ -18,13 +18,13 @@ export interface DNSValidatedCertificateProps extends CertificateProps {
  * A certificate managed by AWS Certificate Manager.  Will be automatically
  * validated using DNS validation against the specified Route 53 hosted zone.
  */
-export class DNSValidatedCertificate extends cdk.Construct implements ICertificate {
+export class DnsValidatedCertificate extends cdk.Construct implements ICertificate {
     public readonly certificateArn: string;
     private normalizedZoneName: string;
     private hostedZoneId: string;
     private domainName: string;
 
-    constructor(scope: cdk.Construct, id: string, props: DNSValidatedCertificateProps) {
+    constructor(scope: cdk.Construct, id: string, props: DnsValidatedCertificateProps) {
         super(scope, id);
 
         this.domainName = props.domainName;
@@ -80,7 +80,7 @@ export class DNSValidatedCertificate extends cdk.Construct implements ICertifica
         };
     }
 
-    public validate(): string[] {
+    protected validate(): string[] {
         const errors: string[] = [];
         // Ensure the zone name is a parent zone of the certificate domain name
         if (!this.domainName.endsWith('.' + this.normalizedZoneName)) {
diff --git a/packages/@aws-cdk/aws-certificatemanager/lib/index.ts b/packages/@aws-cdk/aws-certificatemanager/lib/index.ts
index 50873fe8ee56f..85e821e42fbb6 100644
--- a/packages/@aws-cdk/aws-certificatemanager/lib/index.ts
+++ b/packages/@aws-cdk/aws-certificatemanager/lib/index.ts
@@ -1,4 +1,5 @@
 export * from './certificate';
+export * from './dns-validated-certificate';
 
 // AWS::CertificateManager CloudFormation Resources:
 export * from './certificatemanager.generated';
diff --git a/packages/@aws-cdk/aws-certificatemanager/test/test.dns-validated-certificate.ts b/packages/@aws-cdk/aws-certificatemanager/test/test.dns-validated-certificate.ts
index 0c66841ecf0cd..7920e0d41b9e9 100644
--- a/packages/@aws-cdk/aws-certificatemanager/test/test.dns-validated-certificate.ts
+++ b/packages/@aws-cdk/aws-certificatemanager/test/test.dns-validated-certificate.ts
@@ -2,7 +2,7 @@ import { expect, haveResource } from '@aws-cdk/assert';
 import { PublicHostedZone } from '@aws-cdk/aws-route53';
 import { Stack } from '@aws-cdk/cdk';
 import { Test } from 'nodeunit';
-import { DNSValidatedCertificate } from '../lib/dns-validated-certificate';
+import { DnsValidatedCertificate } from '../lib/dns-validated-certificate';
 
 export = {
   'creates CloudFormation Custom Resource'(test: Test) {
@@ -12,7 +12,7 @@ export = {
       zoneName: 'example.com'
     });
 
-    const cert = new DNSValidatedCertificate(stack, 'Certificate', {
+    new DnsValidatedCertificate(stack, 'Certificate', {
       domainName: 'test.example.com',
       hostedZone: exampleDotComZone,
     });
@@ -77,9 +77,6 @@ export = {
       }
     }));
 
-    const errors = cert.validate();
-    test.equal(errors.length, 0);
-
     test.done();
   },
 
@@ -90,7 +87,7 @@ export = {
       zoneName: 'hello.com'
     });
 
-    const refProps = new DNSValidatedCertificate(stack, 'Cert', {
+    const refProps = new DnsValidatedCertificate(stack, 'Cert', {
       domainName: 'hello.com',
       hostedZone: helloDotComZone,
     }).export();
@@ -106,14 +103,13 @@ export = {
       zoneName: 'hello.com'
     });
 
-    const cert = new DNSValidatedCertificate(stack, 'Cert', {
+    new DnsValidatedCertificate(stack, 'Cert', {
       domainName: 'example.com',
       hostedZone: helloDotComZone,
     });
 
-    const errors = cert.validate();
-    test.equal(errors.length, 1);
-
+    // a bit of a hack: expect(stack) will trigger validation.
+    test.throws(() => expect(stack), /DNS zone hello.com is not authoritative for certificate domain name example.com/);
     test.done();
   },
 };