Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

certificatemanager : DnsValidatedCertificate doesn't wait long enough #5831

Closed
ralovely opened this issue Jan 16, 2020 · 11 comments · Fixed by #8552
Closed

certificatemanager : DnsValidatedCertificate doesn't wait long enough #5831

ralovely opened this issue Jan 16, 2020 · 11 comments · Fixed by #8552
Assignees
@skinny85
Labels
@aws-cdk/aws-certificatemanager Related to Amazon Certificate Manager effort/large Large work item – several weeks of effort feature-request A feature should be added or improved. in-progress This issue is being actively worked on.

Comments

@ralovely
Copy link

Hi.

I'm running into this issue still.
Twice in a row, I've had a certificate take just above 10mn to validate, where the function is set to timeout after 9:30 (ironic).
When creating a DNS validated certificate via the console, there is a warning saying it can take 30mn, or more. I'm sure this would be an extreme case, but apparently, 10mn is not long enough.

Could we increase maxAttempts a tad more ?
(personally, I'd double go with 60 to match the console warning).

Cheers.

  • CDK CLI Version: 1.19.0 (build 5597bbe)
  • Module Version: "@aws-cdk/aws-certificatemanager@^1.21.0"
  • OS: OSX Mojave
  • Language: JS
@ralovely ralovely added the needs-triage This issue or PR still needs to be triaged. label Jan 16, 2020
@SomayaB SomayaB added the @aws-cdk/aws-certificatemanager Related to Amazon Certificate Manager label Jan 16, 2020
@SomayaB SomayaB added the feature-request A feature should be added or improved. label Jan 16, 2020
@scanning
Copy link

I'm also currently experiencing the same issue. I've used this approach before and it's worked successfully but it isn't at the moment. It seems DNS must just be taking longer to update & propagate.

@starsolutions
Copy link

There is an issue, where the lambda hit's a max timeout at 15 minutes, which is I think why the limits are currently set where they are. I'm playing around with an idea where we could get around that limit. Will open a PR if it works :)

@rix0rrr rix0rrr assigned skinny85 and unassigned rix0rrr Jan 23, 2020
@skinny85 skinny85 added guidance Question that needs advice or information. response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. and removed feature-request A feature should be added or improved. needs-triage This issue or PR still needs to be triaged. labels Feb 6, 2020
@SomayaB SomayaB removed the response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. label Feb 17, 2020
@skinny85
Copy link
Contributor

@starsolutions any luck?

@skinny85 skinny85 added feature-request A feature should be added or improved. effort/large Large work item – several weeks of effort and removed guidance Question that needs advice or information. labels Mar 19, 2020
@skinny85
Copy link
Contributor

I guess we could migrate DnsValidatedCertificate to our new custom resource framework.

@Dzhuneyt Dzhuneyt mentioned this issue Mar 22, 2020
Closed
nlang added a commit to nlang/aws-cdk that referenced this issue Mar 29, 2020
@nlang
fix(acm-certificatemanager): DnsValidatedCertificate doesn't wait lon…
1e919a9 
…g enough

fixes aws#5831
nlang added a commit to nlang/aws-cdk that referenced this issue Mar 29, 2020
@nlang
fix(acm-certificatemanager): DnsValidatedCertificate doesn't wait lon…
96d835d 
…g enough

fixes aws#5831
nlang added a commit to nlang/aws-cdk that referenced this issue Mar 31, 2020
@nlang
fix(acm-certificatemanager): DnsValidatedCertificate doesn't wait lon…
4120a34 
…g enough

fixes aws#5831
changed parameter references
nlang added a commit to nlang/aws-cdk that referenced this issue Mar 31, 2020
@nlang
fix(acm-certificatemanager): DnsValidatedCertificate doesn't wait lon…
2f92e3e 
…g enough

fixes aws#5831
changed parameter references
nlang added a commit to nlang/aws-cdk that referenced this issue Mar 31, 2020
@nlang
fix(acm-certificatemanager): DnsValidatedCertificate doesn't wait lon…
8ff9932 
…g enough

fixes aws#5831
changed parameter references
nlang added a commit to nlang/aws-cdk that referenced this issue Apr 2, 2020
@nlang
fix(acm-certificatemanager): DnsValidatedCertificate doesn't wait lon…
70514f9 
…g enough

fixes aws#5831
nlang added a commit to nlang/aws-cdk that referenced this issue Apr 2, 2020
@nlang
fix(acm-certificatemanager): DnsValidatedCertificate doesn't wait lon…
7a51c42 
…g enough

added lambda permissions
fixes aws#5831
@nlang nlang mentioned this issue Apr 2, 2020
Closed
nlang added a commit to nlang/aws-cdk that referenced this issue Apr 2, 2020
@nlang
fix(acm-certificatemanager): DnsValidatedCertificate doesn't wait lon…
9643d8e 
…g enough

fixed test for IAM policy
fixes aws#5831
nlang added a commit to nlang/aws-cdk that referenced this issue Apr 2, 2020
@nlang
fix(acm-certificatemanager): DnsValidatedCertificate doesn't wait lon…
3b6a037 
…g enough

fixing test for IAM policy
fixes aws#5831
nlang added a commit to nlang/aws-cdk that referenced this issue Apr 3, 2020
@nlang
fix(acm-certificatemanager): DnsValidatedCertificate doesn't wait lon…
39e6113 
…g enough

updated ref params
fixes aws#5831
nlang added a commit to nlang/aws-cdk that referenced this issue Apr 3, 2020
@nlang
fix(acm-certificatemanager): DnsValidatedCertificate doesn't wait lon…
8e239f9 
…g enough

fixing related tests
fixes aws#5831
@SomayaB SomayaB added the in-progress This issue is being actively worked on. label Apr 3, 2020
@starsolutions
Copy link

@skinny85 - Sorry for being out of the loop for a while. Unfortunately I hadn't gotten a chance to look at it, got pulled into some other things. Glad to see this is in progress though. Let me know @nlang if there is anything that I can help with

jogold added a commit to jogold/aws-cdk that referenced this issue Jun 15, 2020
@jogold
feat(certificate-manager): native CloudFormation DNS validated certif…
89122f9 
…icate

Automatically adding Amazon Route 53 CNAME records for DNS validation is
now natively supported by CloudFormation.

Add a `validation` prop to `Certificate` to handle both email and DNS
validation. Deprecate `DnsValidatedCertificate`.

The default remains email validation (non-breaking).

Closes aws#5831
Closes aws#5835
Closes aws#6081
Closes aws#6516
Closes aws#7150
Closes aws#7941
Closes aws#7995
Closes aws#7996
jogold added a commit to jogold/aws-cdk that referenced this issue Jun 15, 2020
@jogold
feat(certificatemanager): native CloudFormation DNS validated certifi…
adb63fc 
…cate

Automatically adding Amazon Route 53 CNAME records for DNS validation is
now natively supported by CloudFormation.

Add a `validation` prop to `Certificate` to handle both email and DNS
validation. Deprecate `DnsValidatedCertificate`.

The default remains email validation (non-breaking).

Closes aws#5831
Closes aws#5835
Closes aws#6081
Closes aws#6516
Closes aws#7150
Closes aws#7941
Closes aws#7995
Closes aws#7996
@jogold jogold mentioned this issue Jun 15, 2020
Merged
@SergeyRusskih
Copy link

I guess we could migrate DnsValidatedCertificate to our new custom resource framework.

What did you mean by the 'new custom resource framework'? Do you have any workaround in mind?

@mergify mergify bot closed this as completed in #8552 Jul 10, 2020
mergify bot pushed a commit that referenced this issue Jul 10, 2020
@jogold
feat(certificatemanager): native CloudFormation DNS validated certifi…
337279f 
…cate (#8552)

Automatically adding Amazon Route 53 CNAME records for DNS validation is
now natively supported by CloudFormation.

Add a `validation` prop to `Certificate` to handle both email and DNS
validation. `DnsValidatedCertificate` is now only useful for cross-region
certificate creation.

The default remains email validation (non-breaking).

Closes #5831
Closes #5835
Closes #6081
Closes #6516
Closes #7150
Closes #7941
Closes #7995
Closes #7996
Closes #8282 
Closes #8659
Closes #8783

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@ralovely
Copy link
Author

I think #8552 shouldn't close this.
DnsValidatedCertificate is still very much "active" given it's the only way to do cross-region, and the timeout issue should be at least improved, if not fixable.

The Lambda timeout is not something we can work around, but we should at least increase this function's timeout to the maximum Lambda allows.
Currently, it's 19x30s. I found (from a very un-scientifical gut estimation) that without modifying the timeout, I get around 50/60% success, against 80/90% when setting the timeout to 29x30sec.
Not perfect, but it would make this function as reliable as it can be (while waiting for native CFn cross-domain certificates).

@nlang
Copy link
Contributor

nlang commented Aug 8, 2020

@ralovely @skinny85 I already created a fix for this but the PR is outdated and was closed. If this is still an issue worth fixing I can rebase my PR on current master. Just let me know.

@ralovely
Copy link
Author

ralovely commented Aug 8, 2020

@nlang since I change the timeout each time before creating a new certificate, I haven't encountered it lately, but I also see no reason it wouldn't be needed anymore either.
Given the change is minor and probably safe, if it can save a few headaches to other people, I'd say it's worth it.

Thank you.

@bundgaard
Copy link

We are currently experiencing this problem, should we create a new issue ticket or can we hi-jack this?

@Stf-F
Copy link

Stf-F commented Apr 13, 2021

Same problem here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@skinny85 skinny85

Labels
@aws-cdk/aws-certificatemanager Related to Amazon Certificate Manager effort/large Large work item – several weeks of effort feature-request A feature should be added or improved. in-progress This issue is being actively worked on.
Projects
None yet
Milestone
No milestone
10 participants
@ralovely @scanning @skinny85 @bundgaard @rix0rrr @nlang @starsolutions @SergeyRusskih @SomayaB @Stf-F