# Ensure CloudFront Distribution Uses a Custom SSL/TLS Certificate

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890025743618-ensure-cloudfront-distribution-uses-a-custom-ssltls-certificate
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Amazon CloudFront distributions serving traffic on a custom domain name use a custom SSL/TLS certificate (issued or imported via AWS Certificate Manager) associated with that domain, rather than relying solely on the default \*.cloudfront.net certificate.

**Rationale**

The default CloudFront certificate only validates the distribution's cloudfront.net domain name, not the organization's custom domain, so clients connecting via a custom domain (using SNI or a dedicated IP) require a certificate that matches that domain in order for TLS validation to succeed and to avoid certificate warnings that could train users to ignore legitimate security warnings or that could be exploited by a lookalike domain.

**Impact**

-   Ensures clients connecting via the organization's custom domain receive a properly matching, trusted certificate
    
-   Avoids TLS certificate warnings that could degrade user trust or mask real phishing risks
    
-   Requires timely renewal or replacement of the custom certificate before its expiration to avoid an outage
    

**Default Value**

By default, a newly created CloudFront distribution uses the default \*.cloudfront.net certificate unless a custom domain and certificate are explicitly configured.

**Pre-Requisites**

-   An ACM certificate (in the us-east-1 Region, as required by CloudFront) covering the custom domain name(s) used by the distribution
    
-   IAM permissions to update CloudFront distributions (cloudfront:UpdateDistribution)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon CloudFront and select the distribution to review.
    
3.  Open the General tab (or Settings section) and review the Alternate domain names (CNAMEs) and the associated SSL certificate.
    
4.  Verify that a Custom SSL Certificate is selected, matching the alternate domain name(s) configured, rather than the Default CloudFront Certificate.
    
5.  If the distribution uses a custom domain but relies on the default certificate, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS Certificate Manager in the us-east-1 (N. Virginia) Region and request or import a certificate covering the custom domain(s).
    
3.  Complete domain validation for the certificate.
    
4.  Navigate to Amazon CloudFront and select the distribution to update.
    
5.  Select Edit on the General settings, add the Alternate domain name(s) (CNAMEs) if not already present, and under Custom SSL certificate, select the certificate created above.
    
6.  Save the changes and wait for the distribution to finish deploying.
    
7.  Verify that requests to the custom domain now present the custom certificate.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon CloudFront and select the affected distribution.
    
3.  Select Edit on the General settings and change the certificate back to Default CloudFront Certificate, removing the alternate domain name(s) as needed.
    
4.  Save the changes and wait for the distribution to finish deploying.
    

**Reference**

-   [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-alternate-domain-names.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-alternate-domain-names.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.