Attaching Certificate to CloudDistribution with ARN fails with InvalidViewerCertificate

Question

I'm trying to create a CloudFront Distribution using the AWS SDK under NodeJS and when I set the ARN of the cert like so

ViewerCertificate: {
    ACMCertificateArn: cert_arn,
    CertificateSource: 'acm',
    CloudFrontDefaultCertificate: false,
    MinimumProtocolVersion: 'TLSv1.1_2016',
    SSLSupportMethod: 'sni-only'
}

And then call...

cloudfront.createDistribution()

I get...

InvalidViewerCertificate: The specified SSL certificate doesn't exist, isn't in us-east-1 region, isn't valid, or doesn't include a valid certificate chain

When I create the cert I:

• set the right record for verification in Route 53
• I wait until the cert is validated

Only then I try to create a Distribution, which fails. Funny thing, If I

• hardcode a Cert ARN that I already have,
• wait for the Distribution finish doing its business
• Manually switch with the cert that I created with the steps described above, it works without a problem. I literally select it from the drop down menu and done.

What am I missing here?

Answer 1

The CertificateSource filed has been deprecated and instead we have to use one of the following:

ViewerCertificate$ACMCertificateArn ViewerCertificate$IAMCertificateId ViewerCertificate$CloudFrontDefaultCertificate