Description

Ensure that Amazon CloudFront distributions serving traffic on a custom domain name use a custom SSL/TLS certificate (issued or imported via AWS Certificate Manager) associated with that domain, rather than relying solely on the default *.cloudfront.net certificate.

Rationale

The default CloudFront certificate only validates the distribution's cloudfront.net domain name, not the organization's custom domain, so clients connecting via a custom domain (using SNI or a dedicated IP) require a certificate that matches that domain in order for TLS validation to succeed and to avoid certificate warnings that could train users to ignore legitimate security warnings or that could be exploited by a lookalike domain.

Impact

  • Ensures clients connecting via the organization's custom domain receive a properly matching, trusted certificate

  • Avoids TLS certificate warnings that could degrade user trust or mask real phishing risks

  • Requires timely renewal or replacement of the custom certificate before its expiration to avoid an outage

Default Value

By default, a newly created CloudFront distribution uses the default *.cloudfront.net certificate unless a custom domain and certificate are explicitly configured.

Pre-Requisites

  • An ACM certificate (in the us-east-1 Region, as required by CloudFront) covering the custom domain name(s) used by the distribution

  • IAM permissions to update CloudFront distributions (cloudfront:UpdateDistribution)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon CloudFront and select the distribution to review.

  3. Open the General tab (or Settings section) and review the Alternate domain names (CNAMEs) and the associated SSL certificate.

  4. Verify that a Custom SSL Certificate is selected, matching the alternate domain name(s) configured, rather than the Default CloudFront Certificate.

  5. If the distribution uses a custom domain but relies on the default certificate, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Certificate Manager in the us-east-1 (N. Virginia) Region and request or import a certificate covering the custom domain(s).

  3. Complete domain validation for the certificate.

  4. Navigate to Amazon CloudFront and select the distribution to update.

  5. Select Edit on the General settings, add the Alternate domain name(s) (CNAMEs) if not already present, and under Custom SSL certificate, select the certificate created above.

  6. Save the changes and wait for the distribution to finish deploying.

  7. Verify that requests to the custom domain now present the custom certificate.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon CloudFront and select the affected distribution.

  3. Select Edit on the General settings and change the certificate back to Default CloudFront Certificate, removing the alternate domain name(s) as needed.

  4. Save the changes and wait for the distribution to finish deploying.

Reference