Google Domains SSL Certificate Not Applied to Subdomain on EC2

Understanding the Architecture

It is crucial to understand that SSL/TLS termination does not happen at the registrar level. When you purchase a domain through Google Domains, you are only managing the DNS records that point traffic to your resources. The actual cryptographic handshake occurs between the client browser and your web server or load balancer.

AWS Certificate Manager (ACM) provides free public TLS certificates for services like Amazon API Gateway, Elastic Load Balancing, Amazon CloudFront, and AWS Outposts. These certificates are specific to an AWS Region and cannot be exported to other cloud providers or local servers. Therefore, if your EC2 instance is behind an Application Load Balancer (ALB), ACM is the correct tool. If your EC2 instance is serving traffic directly without a load balancer, ACM cannot be used directly; you would need to use Let's Encrypt with Certbot instead.

Assumption: Using an Application Load Balancer

This article assumes you are using an Application Load Balancer in front of your EC2 instances, as this is the standard pattern for using ACM certificates. If you are not using an ALB, see the section on alternatives below. For more information on troubleshooting network connectivity issues that might affect DNS resolution, refer to Client Fails TLS Handshake: Troubleshooting Guide.

Step 1: Requesting the Certificate in ACM

Navigate to the AWS Management Console and open the Certificate Manager service. Ensure you have selected the correct AWS Region where your Load Balancer resides. ACM certificates are region-specific, so a certificate issued in US East (N. Virginia) will not work for a Load Balancer in US West (Oregon).

1. Click on Request a certificate.
2. Select Request a public certificate.
3. Enter the fully qualified domain name (FQDN) for your subdomain, such as app.example.com. You can also add additional names if you want the certificate to cover multiple subdomains or the root domain.
4. Choose DNS Validation. This is the recommended method because it is automated and requires no manual file uploads.
5. Review and request the certificate.

Step 2: Configuring DNS Validation in Google Domains

Once the certificate is requested, ACM will generate CNAME records that you must add to your Google Domains DNS configuration. This step proves to AWS that you control the domain.

1. In the ACM console, locate your pending certificate. It will show a status of Pending validation.
2. Click on the certificate ID to view details. Under the DNS records section, you will see two CNAME entries: one for the name and one for the value.
3. Log in to your Google Domains account and navigate to the DNS management page for your domain.
4. Add a new record. Select CNAME as the type.
5. In the Name field, paste the Name value from the ACM console. Do not include your domain suffix unless explicitly instructed by ACM (usually, you just enter the prefix).
6. In the Value field, paste the Value from the ACM console. This is the target domain that points back to AWS.
7. Set the TTL to the default or minimum value allowed by Google Domains.
8. If ACM requested two CNAME records (for redundancy or different record types), repeat the process for the second record.

Step 3: Attaching the Certificate to the Load Balancer

After adding the DNS records, propagation may take anywhere from a few minutes to 48 hours, though it is often much faster. Once the status in ACM changes to Issued, you can attach the certificate.

1. Go to the EC2 Dashboard and select Load Balancers under the Networking section.
2. Select your Application Load Balancer and click the Listeners tab.
3. Edit the HTTPS listener (port 443). If you do not have an HTTPS listener, create one.
4. In the SSL certificate dropdown, select the certificate you just validated.
5. Save the changes.

Troubleshooting Common Issues

If the certificate remains in Pending validation after several hours, check the following:

• Record Type: Ensure you added CNAME records, not A records or TXT records.
• Propagation Delay: Use a tool like dig or online DNS checkers to verify that the CNAME records are publicly visible. Note that Google Domains DNS propagation is usually fast but can occasionally lag.
• Region Mismatch: Verify that the ACM certificate was requested in the same region as your Load Balancer.

For insights on how browsers interpret these certificates, specifically regarding Subject Alternate Names, see How to View Subject Alternate Names in Google Chrome.

Alternative: Direct EC2 Without Load Balancer

If you are not using an Application Load Balancer and your EC2 instance serves traffic directly, ACM cannot be used. In this case, you must install a certificate manually on the EC2 instance itself. The most common approach is using Let's Encrypt with Certbot.

Install Certbot on your Linux instance, run the command sudo certbot --nginx or sudo certbot --apache depending on your web server. Certbot will automatically handle the DNS-01 or HTTP-01 challenge. For DNS-01 challenges with Google Domains, you may need to configure a plugin that interacts with the Google Domains API to create temporary TXT records for validation. This method is more complex than using ACM but necessary for direct EC2 deployments.

Conclusion

Securing a subdomain hosted on EC2 requires separating domain management from certificate issuance. By using Google Domains for DNS and AWS Certificate Manager for SSL, you leverage a robust, automated, and free solution. Always ensure your DNS records match the ACM requirements exactly and that your Load Balancer is configured to terminate SSL traffic using the issued certificate.

Frequently Asked Questions

Can I use an ACM certificate directly on an EC2 instance?

No, AWS Certificate Manager certificates cannot be installed directly on EC2 instances or on-premises servers. They are exclusively designed for AWS-managed services like Load Balancers, CloudFront distributions, and API Gateways. For direct EC2 usage, you must use a third-party CA like Let's Encrypt.

Why is my ACM certificate stuck in "Pending Validation"?

This status usually indicates that the CNAME records added to Google Domains have not yet propagated globally or were entered incorrectly. Verify the exact Name and Value fields in the ACM console match your Google Domains DNS entries. Use a public DNS lookup tool to confirm the records are visible before waiting for automatic validation.

Do I need to renew ACM certificates manually?

No, ACM automatically renews public certificates before they expire. As long as the DNS validation records remain in place and the domain continues to resolve correctly, AWS handles the renewal process seamlessly. You do not need to take any action once the certificate is issued.

What happens if I delete the CNAME records in Google Domains?

If you delete the validation CNAME records, ACM will lose its ability to verify domain ownership. Upon the next renewal attempt, the certificate renewal will fail, and the certificate will eventually expire. This will cause your website to display security warnings to users until valid records are restored and the certificate is renewed.

Can I use ACM for private domains hosted on Google Domains?

ACM supports private certificates for internal resources within a VPC. However, if you are securing a public-facing subdomain accessible via the internet, you must use a public certificate. Public certificates require public DNS validation, which works with Google Domains as described in this guide.