ShortlinkZoneSSLCertEast: Failed to create resource. Certificate not issued in time

[esmo]

Hey there,

I just tried to create a Hubs stack on AWS and I'm stuck. When I try to deploy the stack I get an error with the message mentioned in the title, which causes a rollback.

I registrered two domains with Route 53 yesterday. Both seem to be set up correctly.

I used recipe 3 for the domain setup, since we want to use a subdomain which is hosted elsewhere. But this should not affect the certificate for the short link domain, as far as I understand.

Any hint is very much appreciated.

[esmo]

Just for the record: I registered a new short link domain (the last one was not short at all), and now the deployment worked flawlessly. Maybe the length of the domain name had some side effect?

Anyways, the stack just completed, and I'm curious to get started.

[blairmacintyre]

I don't think the length matters. Is there any chance the DNS was misconfigured, either because you moved the domain from a different AWS account or from another registrar (I had this problem).

[josedc]

Hi @blairmacintyre ... how did you solve the problem after moving the domain from another AWS account?

I spent most of yesterday trying to migrate Hubs Cloud Personal from my personal AWS account in Oregon (working ok since last year) to the school AWS account that I also manage but encountered some error also causing rollbacks:

1. I was able to move 2 domains (kglam.life and kglam.link) and created 3rd (kg360.link) to the school account,
2. I tried running the Hubs CloudFormation stack in
   a) Oregon,
   b) N Virginia and
   c) Japan but all failed,
3. I've tried both Hubs DNS recipes 1 and 2 but no success.

Looks like the same ShortlinkZoneSSLCertEast error reported by @esmo:

After the last rollback from N Virginia, my recently purchased kg360.link (specified as the internal private domain) looks like this:

My kglam.life (specified as the main Hubs domain in DNS recipe 1 or hubs.kglam.life in DNS recipe 2) looks like this:

My kglam.link (specified as the short link domain in DNS recipe 1 and 2) looks like this:

What is preventing the issue of certificates (from the error message) in time?

Regards,
Jose

[josedc]

On more investigation, I realized the Name Servers in "Route53 > Domains > Registered domains" was not the same as the Name Servers in "Route53 > Hosted Zones" for the transferred Hubs and short link domains. I think this was preventing the certificates from being created. However, after I fixed this by making the name servers the same the deleted and re-launched the CloudFormation stack, I got this error:

Anybody have a clue what causes this error?

Resource handler returned message: "Invalid request provided: One or more of the CNAMEs you provided are already associated with a different resource. (Service: CloudFront, Status Code: 409, Request ID: e236765f-8cf7-4ba2-ad6e-350a9a4229e5, Extended Request ID: null)" (RequestToken: c3856874-c82b-89d2-cb00-1c373be11b4b, HandlerErrorCode: InvalidRequest)

I made sure to delete all unnecessary records from the Hosted Zones leaving only the bare NS and SOA records so I don't understand why the CloudFront complains about CNAME's already associated with different resource.

[esmo]

@josedc It's now been a while since I fiddled around with this, so I don't really know. I vaguely remember that I had an issue with the main domain, which was hosted with another domain provider. Maybe you have a similar setup, and it's about the CNAME entry you made there, not in Route53?

[josedc]

Thanks for the hint @esmo .. I found and fixed the problem. Although the domain names and CNAME entries in the new AWS account were clean, somehow there were unused CloudFront entries in the old AWS account still affecting the new CloudFormation stack. It's strange there is no way to see these from the new AWS account and the only way is to search for them in the old AWS account. After deleting these zombie CloudFront entries the new Hubs stack spun up without any errors.