Create an ACM Certificate for CloudFront (us-east-1 required)

CloudFront is a global service. Its SSL/TLS certificates MUST be provisioned in us-east-1 (N. Virginia), regardless of where your other resources are deployed. This is a hard AWS requirement — a certificate in any other region will not work.

Paste into this field

CloudFront → acmCertificateArn

Output looks like

arn:aws:acm:us-east-1:123456789012:certificate/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

1Switch to us-east-1

In the AWS Console, use the region dropdown (top-right) and select "US East (N. Virginia) us-east-1". This step is critical — the certificate will not work with CloudFront if created in any other region.

3Open ACM

Search for "Certificate Manager" in the console search bar and open it.

5Request a public certificate

Click "Request a certificate" → "Request a public certificate" → Next.

7Enter your domain

Enter the exact domain you entered in "Custom Domain Names" on the CloudFront node (e.g. cdn.example.com). They must match.

9DNS validation

Select DNS validation → Request. ACM generates a CNAME record for your domain.

11Add the CNAME to your DNS

Copy the CNAME Name and Value shown in ACM. Add them to your DNS provider (Route 53, Cloudflare, etc.). ACM polls automatically.

13Wait for Issued

Status changes to "Issued" within 2–5 minutes once DNS propagates. Refresh the page.

15Copy the ARN

Click the certificate → copy the ARN at the top. Paste it into "ACM Certificate ARN" on your CloudFront node.

Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.

CloudStack Canvas · Validation Guide