CloudFront distributions should use custom SSL/TLS certificates
Verifies that CloudFront distributions use custom SSL/TLS certificates rather than the default CloudFront certificate.
- service
- CloudFront
- severity
- Low
- scope
- evaluated once per account
How to fix it
Add an alternate domain name to the distribution and attach a certificate covering that name, in place of the CloudFront default certificate. Three pieces have to line up, which is why this is not a toggle: the alternate domain name; a certificate for it held in ACM in the us-east-1 Region, wherever the rest of your infrastructure lives, or imported into IAM; and DNS for the name pointing at the distribution's CloudFront domain, or viewers reach nothing once the name is live.
In the console
CloudFront → Distributions → the distribution → General → Settings → Alternate domain names and Custom SSL certificate
See which of your accounts this check is failing on.
Book a demo