Skip to main content

CloudFront distributions should use custom SSL/TLS certificates

Severity: Medium

Resource Types: AWS::CloudFront::Distribution

Description​

This control checks whether CloudFront distributions are using the default SSL/TLS certificate CloudFront provides. This control passes if the CloudFront distribution uses a custom SSL/TLS certificate. This control fails if the CloudFront distribution uses the default SSL/TLS certificate.

Custom SSL/TLS allow your users to access content by using alternate domain names. You can store custom certificates in AWS Certificate Manager (recommended), or in IAM.

Remediation​

To add an alternate domain name using a custom SSL/TLS certificate for your CloudFront distributions, see Adding an alternate domain name in the CloudFront Developer Guide.