Create an ACM Certificate for an API Gateway Custom Domain

API Gateway custom domains require an ACM certificate. For edge-optimized APIs (the default), the certificate must be in us-east-1. For regional APIs, the certificate must be in the same region as the API. Once created, copy the ARN into "certificateArn".

Paste into this field

API Gateway → certificateArn

Output looks like

arn:aws:acm:us-east-1:123456789012:certificate/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

1Determine API type and region

Edge-optimized (default REST API): certificate must be in us-east-1.

Regional REST API or HTTP API: certificate must be in the same region as the API.

4Switch to the correct region

Use the region selector (top-right) to switch to the required region.

6Open ACM and request a certificate

Navigate to Certificate Manager → "Request a certificate" → "Request a public certificate" → Next.

8Enter your custom domain

Enter the domain you set in "Custom Domain Name" on the API Gateway node (e.g. api.example.com). They must match exactly.

10DNS validation

Select DNS validation → Request. Add the shown CNAME record to your DNS provider.

12Wait for Issued status

Refresh the ACM certificate list until status is "Issued" (2–5 minutes).

14Copy and paste the ARN

Click the certificate → copy the ARN. Paste it into "ACM Certificate ARN" on your API Gateway node.

Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.

CloudStack Canvas · Validation Guide