Question about: https://exanubes.com/blog/sharing-a-domain-name-across-multiple-aws-accounts

[ImreC]

Hi, I read your blog post about sharing a domain name across multiple AWS accounts. Did requesting a certificate through ACM using DNS validation work for you using this approach or are there any additional steps? It seems to get stuck on Pending Validation and you specifically mention getting certificates in the article. Apologies for reaching out this way. I hope you don't mind.

[exanubes]

Hey, no worries, thanks for reaching out. Im gonna have to take a look and will get back to you ASAP. Off the top of my head I remember I had an issue with certificates stuck in pending as well. I don’t remember exactly the rules but I think I had to create it in the virginia-1 region (the “main” one), but I’ll take a look and will let you know. Cheers Sent from Proton Mail for iOS

…

On Sat, Feb 4, 2023 at 11:21, ImreC ***@***.***> wrote: Hi, I read your blog post about sharing a domain name across multiple AWS accounts. Did requesting a certificate through ACM using DNS validation work for you using this approach or are there any additional steps? It seems to get stuck on Pending Validation and you specifically mention getting certificates in the article. Apologies for reaching out this way. I hope you don't mind. — Reply to this email directly, [view it on GitHub](#1), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AT2FKZ3UMZYISMLQ5MA4ZR3WVYUUHANCNFSM6AAAAAAURCZ7U4). You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[ImreC]

Really appreciate the response. I am now leaning towards catching the validation email with an MX record in the main account and an SNS + lambda handler to get the link, but this is obviously like something more automated. The docs on AWS are really unclear about this.

For example this blog post doesn't really give any information on how to do it at all:
https://aws.amazon.com/premiumsupport/knowledge-center/acm-export-certificate/

This is on the cloudformation page on creating the certificate through there:

I also wasn't able to create it through the console though. Same problem. It just gets stuck at validating regardless of DNS records being available. I tried the main account as well as the sub-domain account.

[exanubes]

@ImreC So here's the thing. Not sure what kind of setup you're running so I'm gonna tell you about mine.

I have my domain (exanubes.com) in route53, but the hosting and ssl is actually handled via netlify. To do that I had to swap the ns record for apex in route53 to netlify's ns servers.
To summarize I have the same ns records for exanubes.com in netlify dns settings and in route53.

Now let's say I want to have a subdomain in a different hosted zone e.g test.imrec.exanubes.com. Normally I would just put the subdomain's name servers in a ns record for the apex, however, I'm hosting via netlify so I had to go to netlify's console and add them there.

To be frank I did not check if I need them in route53 and netlify. I added the ns record for the subdomain in both places.

NS Record inside the test.imrec.exanubes.com hosted zone

NS Record for the test.imrec.... hosted zone inside apex HZ

NS Records for the test.imrec.... inside Netlify DNS Settings

Issued ACM Certificate

Hope this helps, good luck!

[ImreC]

@exanubes I felt like I was trying this before, but I might have made a copy mistake in the NS record or something. This works perfectly now. Thanks a lot! Really appreciate your help :) Let me know if I can return the favor.