DnsValidatedCertificate reports DNS zone example.com to be non-authoritative

[alekitto]

When requesting a DnsValidatedCertificate using an imported HostedZone (imported with HostedZoneProvider.findAndImport) not previously saved in cdk.context.json, validation fails with error DNS zone example.com is not authoritative for certificate domain name cdn.mydomain.com

Same error is present when requesting the certificate for the root domain name:

new DnsValidatedCertificate(stack, 'MyCertificate', {
    domainName: 'mydomain.com',
    hostedZone,
});

results in: DNS zone mydomain.com is not authoritative for certificate domain name mydomain.com

[troyready]

Anyone else experiencing this too? Seems like an issue with findAndImport specifically, works with a direct HostedZone.import

[jarikujansuu]

During weekend I tried project based on CDK examples and it uses that findAndImport (https://github.com/aws-samples/aws-cdk-examples/blob/master/typescript/static-site/static-site.ts) and had same problem

Have to see if import works

[waynerobinson]

I'm having exactly the same problem.

[zacharycarter]

I believe it's caused by this -

const DEFAULT_HOSTED_ZONE: HostedZoneContextResponse = {
  Id: '/hostedzone/DUMMY',
  Name: 'example.com',
};

  public findHostedZone(): HostedZoneAttributes {
    const zone = this.provider.getValue(DEFAULT_HOSTED_ZONE) as HostedZoneContextResponse;
    // CDK handles the '.' at the end, so remove it here
    if (zone.Name.endsWith('.')) {
      zone.Name = zone.Name.substring(0, zone.Name.length - 1);
    }
    return {
      hostedZoneId: zone.Id,
      zoneName: zone.Name,
    };
  }
}

https://github.com/awslabs/aws-cdk/blob/master/packages/%40aws-cdk/aws-route53/lib/hosted-zone-provider.ts

Seems that it's always using the default.

[stefanorg]

I've the same problem, anyone found a solution?

[BlueYetii]

I've found the same issue while trying to create some certificates today. The workaround (although not pretty) was to create a separate stack that just imports the hosted zone and makes the imported zone available to pass to other stacks. Then running cdk synth -e HostedZoneStack generates the correct cdk.context.json allowing other stacks containing the certificates to be deployed.

Hosted Zone Stack

import cdk = require('@aws-cdk/cdk');
import route53 = require('@aws-cdk/aws-route53');

export interface HostZoneStackProps extends cdk.StackProps {
    /**
     * Root level domain for the hosted zone
     */
    domain: string;
}

export class HostZoneStack extends cdk.Stack {
    public hostedZone: route53.IHostedZone;

    constructor(scope: cdk.Construct, id: string, props: HostZoneStackProps) {
        super(scope, id, props);

        this.hostedZone = new route53.HostedZoneProvider(this, {
                domainName: props.domain,
                privateZone: false
        }).findAndImport(this, "HostedZone");
    }
}

Example App

#!/usr/bin/env node
import "source-map-support/register";
import cdk = require("@aws-cdk/cdk");
import { ApplicationStack } from "../lib/application-stack";
import { HostZoneStack } from "../lib/hosted-zone-stack";

const app = new cdk.App();

const hostedZoneStack = new HostZoneStack(app, "HostedZoneStack", {
    domain: "somedomain.com"
});

new ApplicationStack(app, "StaticSiteStack", {
    hostedZone: hostedZoneStack.hostedZone, // imported zone passed in the stack props
    uiDomain: "ui.somedomain.com",
    env: {
        region: "us-east-1"
    }
});

[bind-almir]

I had the same issue and came up with this workaround:

this.hostedZoneProvider = new HostedZoneProvider(this, {
  domainName: props.domainName,
  privateZone: props.privateZone
});

const zone: HostedZoneAttributes = this.hostedZoneProvider.findHostedZone();

this.hostedZone = HostedZone.fromHostedZoneAttributes(this, 'HostedZone', {
  hostedZoneId: zone.hostedZoneId,
  zoneName: zone.zoneName
});

I am not sure was this right thing to do but it works for me. Is there a better solution?

[rpanfili]

I found, as a workaround, that if the hosted zone reference is still unresolved and contains the dummy values (example.com) you can simply return and wait for the next AppStack synth iteration when cdk will use the HostedZoneContextProviderPlugin to get real values from your account.

Take a look here:
https://github.com/awslabs/aws-cdk/blob/23a143ea34a1654af24bf8c58f73da26136d039e/packages/aws-cdk/lib/api/cxapp/stacks.ts#L205-L207

So a working (boilerplate) solution is:

  const domainName = "foobar.com";

  const zone = new HostedZoneProvider(this, {
    domainName
  }).findAndImport(this, "HostedZone");
  if (zone.zoneName == 'example.com') {
    return;
  }
  const certificate = new DnsValidatedCertificate(this, 'ApiSSLCertificate', {
    domainName,
    hostedZone: zone
  });

Warning: Obviously the given domainName hosted zone should exists in your account otherwise you will get an error like this

Found zones: [] for dns:foobar.com, privateZone:undefined, vpcId:undefined, but wanted exactly 1 zone

[BlueYetii]

Nice workaround @rpanfili, much easier solution to the issue.