A developer is setting up api.example.com as a custom domain name for an edge-optimized REST API deployed in eu-west-2.
A public certificate for the name was issued in AWS Certificate Manager (ACM) in eu-west-2, but API Gateway does not offer it when the custom domain is created. The API must stay edge-optimized.
What should the developer do?
Choose one answer.
AA. Request a public certificate for api.example.com in ACM in us-east-1 and select it for the custom domain.
BB. Change the API's endpoint type to Regional so that the eu-west-2 certificate can be used.
CC. Request a private certificate for the name from AWS Private CA in eu-west-2 and select that one.
DD. Keep the certificate in eu-west-2 and wait for ACM to replicate it to the API's CloudFront distribution.
Show the answer and explanation
Answer: A
A. Right: Correct. Edge-optimized custom domains use a CloudFront distribution, so the certificate must be requested or imported in US East (N. Virginia). Regional custom domains use a certificate from the API's own Region. Learn more: Custom domain name prerequisites (opens in a new tab)
B. Wrong: A Regional custom domain does accept a certificate from the API's Region, but this changes the API into something other than edge-optimized. That conflicts with the requirement to keep the endpoint type. Learn more: Custom domain name prerequisites (opens in a new tab)
C. Wrong: The Region is still wrong, because an edge-optimized domain needs a certificate in us-east-1. A private certificate would also not be trusted by public clients. Learn more: What is AWS Private CA? (opens in a new tab)
An edge-optimized API uses a CloudFront distribution, and API Gateway requires its custom domain certificate to be requested or imported in us-east-1, whatever Region the API is in. Moving the certificate between Regions is not automatic, and switching to a Regional endpoint would break the requirement to stay edge-optimized.
Want more on Certificates and encryption in transit? The 5 full-length practice sets have 9 more Certificates and encryption in transit questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →