AWS Amplify Support
AWS Amplify custom domain and SSL certificate setup.
Adding a custom domain to Amplify issues a certificate and needs DNS records that prove ownership and route traffic. Domains get stuck on pending verification when records are wrong, conflicting or placed at the wrong DNS provider. We fix DNS so the certificate issues and the site serves over HTTPS.
When You Need This
The situations where this work pays for itself.
Signs it is time
- The domain shows 'Pending verification' or 'Pending deployment' for a long time
- Browsers show a certificate warning or name mismatch
- The apex domain does not work but www does
- DNS is hosted outside Route 53
- You moved the domain from another host and the old records conflict
What you get
- A final DNS record set for apex, www and validation
- Amplify domain settings and redirects
- A verification checklist with dig results
- Notes on who manages DNS and renewal
How we do it
A clear, safe process you can follow along with.
1. Find where DNS is actually hosted
We check the registrar's nameservers to see which provider answers for the domain. Records added in the wrong zone are the most common reason verification never completes.
2. Add the validation and routing records
Amplify shows a CNAME for certificate validation and a CNAME or ALIAS for the CloudFront distribution that serves the app. In Route 53 Amplify can add them for you. At other providers we add them exactly as shown.
3. Handle the apex domain
A CNAME is not allowed at the zone apex under standard DNS. We use Route 53 alias records, or ALIAS or ANAME at providers that support them, or redirect the apex to www.
4. Remove conflicts
Old A, AAAA or CNAME records for the same name, or a CAA record that does not authorize Amazon's certificate authorities, stop issuance or routing. We clean these up.
5. Wait, then verify
DNS propagation and certificate issuance can take time. We check with dig or nslookup and confirm status in the Amplify console, then test HTTPS, redirects and the certificate chain in a browser.
6. Set up redirects and renewal checks
We configure www to apex or the reverse, and verify that validation records stay in DNS, since removing them can block certificate renewal.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Deleting the validation CNAME afterward
It may be required for renewal. Leave it in place.
Using a CNAME at the apex
It breaks other records such as MX. Use an alias-type record.
Leaving old records pointing to the previous host
Visitors get the old site or a certificate mismatch.
Editing the wrong DNS zone
Verify the registrar's nameservers first.
Frequently Asked Questions
Why is my Amplify domain stuck on pending verification?
The required validation CNAME is missing, in the wrong DNS zone, or has a typo. A CAA record blocking Amazon's certificate authorities can also stop it.
Can I use a domain managed outside Route 53?
Yes. You add the records Amplify provides at your DNS provider, and for the apex you need ALIAS or ANAME support or a redirect.
Do I need to buy a certificate?
Amplify issues and renews a managed certificate for your domain through AWS Certificate Manager, or you can supply your own where supported.
Want Help With AWS Amplify custom domain and SSL certificate setup?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required