Knowledge Base

How to install and bind a server certificate on AWS CloudFront

Updated on June 13, 2026

Overview

By the end of this guide, you will have imported or requested an SSL/TLS certificate in AWS Certificate Manager (ACM) in the required region and bound it to your Amazon CloudFront distribution so the site is served securely over HTTPS. It covers the prerequisites, requesting or importing the certificate in the US East (N. Virginia) region (us-east-1) — the only region CloudFront can read certificates from — adding your Alternate Domain Names (CNAMEs), and selecting the certificate and security policy on the distribution. The certificate appears for the distribution only if its Subject Alternative Names (SANs) include your domains.

Prerequisites

Access to the AWS Management Console with permission to manage AWS Certificate Manager (ACM) and CloudFront

A valid SSL/TLS certificate (imported or requested through ACM)

Domain ownership verification completed (for ACM-issued certificates)

The custom domain names (Alternate Domain Names, or CNAMEs) added or planned for the CloudFront distribution

Step 1: Request or import a certificate in ACM

Switch your region to US East (N. Virginia) (us-east-1) in the top-right corner.

Figure 1: Sign in to the AWS Management Console and Switch the region to US East (N. Virginia) (us-east-1)

Go to AWS Certificate Manager (ACM) and import a third-party certificate, providing the certificate body, private key, and certificate chain.

Figure 2,3 & 4: Import the certificate in AWS Certificate Manager (ACM)

Wait until the certificate status changes to "Issued" before continuing.

Figure 5: Certificate Status changed to “Issued”

Step 2: Bind the certificate to your CloudFront distribution

Open the Amazon CloudFront console in the same us-east-1 region.

Figure 6: Open the Amazon CloudFront console

Select the Distribution ID you want to update, open the General tab, and choose Edit.

Figure 7 & 8: Select the distribution ID and choose Edit

In Alternate Domain Names (CNAMEs), confirm your custom domain names are listed.

Figure 9: Confirm the Alternate Domain Names (CNAMEs)

In Custom SSL Certificate (Viewer Certificate), select the ACM certificate from the dropdown. It appears only if it is in us-east-1 and its Subject Alternative Names (SANs) include the listed domains.

Figure 10: Select the ACM certificate under Viewer Certificate

Choose a security policy (for example, TLSv1.2_2021) and choose Save changes.

Figure 11 & 12: Choose the security policy and save changes

Changes take time to propagate across the CloudFront edge locations; the distribution status shows InProgress until deployment completes. Once deployed, your website is accessible over HTTPS with the new certificate.