Introduction

If CloudFront greys out the custom SSL certificate field, the certificate usually exists but does not meet CloudFront’s selection rules. The most common cause is regional mismatch, but validation state, domain coverage, and IAM access can also block selection.

Why CloudFront Hides the Certificate

CloudFront is a global service, but ACM certificates used for viewer HTTPS must live in us-east-1. Creating the certificate in another region is enough to make the console show the option as disabled or omit the certificate from the list. AWS documents this explicitly for certificates attached to CloudFront distributions.

The certificate also has to be usable for the distribution you are editing. That means:

• It must be issued or imported into ACM, not still pending.
• Its domain names must cover the alternate domain names on the distribution.
• The account and IAM principal must have permission to list and attach ACM certificates.

A simple example is a distribution configured for cdn.example.com while the certificate only covers api.example.com. CloudFront will reject that combination even if the certificate is otherwise valid.

Verify the Certificate First

Start by checking the certificate in the correct region:

aws acm list-certificates \
  --region us-east-1 \
  --certificate-statuses ISSUED

Then inspect the certificate you expect to use:

aws acm describe-certificate \
  --region us-east-1 \
  --certificate-arn arn:aws:acm:us-east-1:123456789012:certificate/abcd-1234

Look for three things in the response:

• 'Status should be ISSUED.'
• 'DomainName and SubjectAlternativeNames should cover your CloudFront aliases.'
• The ARN should be in us-east-1.

If the certificate was requested in ca-central-1, eu-west-1, or any region other than us-east-1, request or import a new one in us-east-1. ACM certificates are regional resources; you cannot "move" one after creation.

Attach It to CloudFront

Once the certificate is valid, confirm the distribution aliases:

aws cloudfront get-distribution-config \
  --id E123EXAMPLE

If the aliases and certificate match, update the distribution by setting the ACM certificate ARN and SNI support method. Many teams do this through infrastructure as code, but the CLI flow is still useful for debugging.

Example CloudFront fragment:

1{
2  "Aliases": {
3    "Quantity": 1,
4    "Items": ["cdn.example.com"]
5  },
6  "ViewerCertificate": {
7    "ACMCertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/abcd-1234",
8    "SSLSupportMethod": "sni-only",
9    "MinimumProtocolVersion": "TLSv1.2_2021"
10  }
11}

If the console still behaves oddly, refresh after certificate issuance completes. CloudFront changes are asynchronous, and the UI can lag briefly behind ACM state.

IAM and Account Boundaries

Another subtle issue is permissions. A user who can edit CloudFront but cannot list ACM certificates may see limited or disabled choices. At minimum, the principal generally needs permission to read certificate metadata and update the distribution.

Cross-account setups add another layer. If the certificate is in a different AWS account from the distribution, CloudFront will not simply offer it as a selectable ACM certificate in the usual single-account flow. In practice, most teams keep the distribution and certificate in the same account unless they are using a more specialized architecture.

Common Pitfalls

The biggest mistake is creating the certificate in the wrong region. For CloudFront viewer HTTPS, us-east-1 is not optional.

Another frequent problem is unfinished validation. DNS validation records may not have propagated yet, so ACM still shows PENDING_VALIDATION.

Teams also forget to align aliases. If the distribution uses static.example.com, the certificate must cover that hostname directly or through a matching wildcard such as *.example.com.

Finally, be careful with origin certificates versus viewer certificates. A load balancer behind CloudFront can use a regional certificate in its own region, but the certificate presented by CloudFront to end users still follows the us-east-1 rule.

Summary

• CloudFront only uses ACM certificates for viewer HTTPS when they are in us-east-1.
• The certificate must be ISSUED and must cover every alternate domain name on the distribution.
• IAM permissions can prevent the console from listing or attaching certificates.
• Debug with aws acm list-certificates, aws acm describe-certificate, and aws cloudfront get-distribution-config.
• Separate the viewer-certificate rules from any origin-certificate setup behind CloudFront.