DnsValidatedCertificate (deprecated) -> Certificate migration steps?

[ChrisLane]

I noticed that DnsValidatedCertificate has been deprecated in favour of Certificate.

What are the steps to migrate from DnsValidatedCertificate to Certificate without any downtime of the certificates?

I have tried changing the following code:

    const serverWildcardCertificate = new acm.DnsValidatedCertificate(
        this,
        envName("server-wildcard-certificate", envShortName),
        {
          domainName: wildcardDomainName,
          hostedZone,
          cleanupRoute53Records: !isMainAccount
        });

Which I changed to the following:

    const serverWildcardCertificate = new acm.Certificate(
        this,
        envName("server-wildcard-certificate", envShortName),
        {
          domainName: wildcardDomainName,
          region: this.region,
          validation: acm.CertificateValidation.fromDns(hostedZone)
        });

But I get the following error:

"Invalid request provided: The specified SSL certificate doesn't exist, isn't in us-east-1 region, isn't valid, or doesn't include a valid certificate chain.

I don't see a property for changing the region.

[ChrisLane]

This may be answered by a response to #23931

[fynnfluegge]

I found the related PR to this issue #21982, maybe the comments in PR will help

[ChrisLane]

As far as I can tell, there doesn't seem to be a good solution in there. Someone commented there asking essentially the same question yesterday.

[therightstuff]

@ChrisLane we now need to create a separate us-east-1 stack containing the certificate before we use the certificate in another region.

[ChrisLane]

That's pretty awful in terms of usability.

…

On 4 Feb 2023, 07:40, at 07:40, Adam Fisher ***@***.***> wrote: @ChrisLane we now need to create a separate `us-east-1` stack containing the certificate before we use the certificate in another region. -- Reply to this email directly or view it on GitHub: #23952 (reply in thread) You are receiving this because you were mentioned. Message ID: ***@***.***>

[tempestrock]

Fully agree. I wonder why DnsValidatedCertificate has been deprecated in the first place. Is there a chance to 'un-deprecate' it?

[stoyan-scava]

I created a pull request to undo the deprecation of DnsValidatedCertificate

#24543

[rehanvdm]

Thank you. To be honest, I am okay with the deprecation, just not that it positions the Certificate construct as a drop-in replacement. I am fine doing a migration, the expectation just needs to be set. Talked more about it here. #21982 (comment)

[GitHub30]

same issue

[greensmith]

very disappointing, the official 'solution' seems like a bit of a cop-out.

they say its to "unburden" themselves , but feels more like shifting the burden to end users with reworking their environments 🤷‍♂️

what other custom resources are they going to drop supporting next, s3deployments? 👎

[peterwoodworth]

Copying my comment from #23931

We have a feature request open for a new construct which will handle the creation of the Certificate from any region (by abstracting away the requirement to create a stack in us-east-1), and we'd be willing to review a PR that implements this.

You can still use DnsValidatedCertificate - deprecation here just means that we won't continue developing on it anymore because it's not the direction we want to continue to head in. However, you should still be able to use it for a long time to come, as we don't have any official plans for a v3.

I'd appreciate it if we could keep discussion around this in the feature request I've linked. It will help consolidate discussion, and also more people will be able to see that feature request and give it a thumbs up, which we use to help us decide what to work on

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.