When users connect to https://app.example.com, the browser shows NET::ERR_CERT_COMMON_NAME_INVALID.
The application uses an ALB HTTPS listener, and Route 53 name resolution is correct.
What should be checked and corrected first?
Associate an ACM certificate that contains the requested hostname in its SAN or wildcard name with the ALB HTTPS listener. DNS TTL does not fix a certificate mismatch.
Detailed explanation
TTL controls DNS response caching; it does not change the certificate name presented by the listener or TLS validation.
TTL controls DNS response caching; it does not change the certificate name presented by the listener or TLS validation.
The certificate name must match the requested hostname for TLS hostname validation. Associating the correctly named ACM certificate with the listener resolves the mismatch.
The certificate name must match the requested hostname for TLS hostname validation. Associating the correctly named ACM certificate with the listener resolves the mismatch.
Storing a certificate in S3 does not change the certificate that the ALB HTTPS listener presents.
Storing a certificate in S3 does not change the certificate that the ALB HTTPS listener presents.
An alarm can notify or invoke an action, but it does not rewrite a certificate SAN or correct listener configuration.
An alarm can notify or invoke an action, but it does not rewrite a certificate SAN or correct listener configuration.
Check official documentation
Compare the following points with the official documentation.
ALB HTTPS listener certificatesとACM managed renewalの公式説明を確認する。
Official references
What to confirm
DNS名前解決、証明書のSAN、HTTPSリスナーの関連付けを分けて証明書エラーを切り分けられる。
Key points
- ACM certificate
- SAN
- HTTPS listener
- Hostname validation
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current behavior in the official SOA-C03 guide and AWS service documentation.
Foundation review
Certificate identity
DNS can locate a load balancer, but the certificate must independently identify the requested hostname.
Listener association
The certificate used for a connection is selected from the HTTPS listener configuration.