title: Cloudfront Alternate Domain Names InvalidViewerCertificateException
body: <p>My setup</p>
  
  <ul>
  <li>EC2: app</li>
  <li>Domain Registrar: namecheap</li>
  <li>DNS: route 53</li>
  </ul>
  
  <p>I use EC2 to host my app, AWS route 53 to direct the url, and cloudfront to fetch the static files for my app. Right now the cloudfront is using unfriendly domain <code>*.cloudfront.net</code>.</p>
  
  <p>I am using certbot inside my EC2 to provide SSL connection.</p>
  
  <p>When I tried to change cloudfront domain name, I use the <code>Custom SSL Certificate</code> generate by ACM (AWS certificate manager). And I encountered the error:</p>
  
  <pre><code>com.amazonaws.services.cloudfront.model.InvalidViewerCertificateException: The certificate that is attached to your distribution doesn't cover the alternate domain name (CNAME) that you're trying to add. For more details, see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#alternate-domain-names-requirements (Service: AmazonCloudFront; Status Code: 400; Error Code: InvalidViewerCertificate; Request ID: 2d39c685-bf17-4d24-9c4b-82955daa878f; Proxy: null)
  </code></pre>
  
  <p>The ACM cert is generated in N.Virginia, which is fine since my EC2 is hosted there. I generated the cert using <code>*.example.com</code> and it is verified.</p>
  
  <p>I am not sure how to fix that. Any advise?</p>