How to Fix AWS Certificates and SES Verification Stuck on Pending in Route 53

Let's say you are working with AWS Route 53 domains, and you are trying to create a certificate or verify a domain name for AWS SES. The verification takes ages or never finishes, no matter how many times you delete the request and create it again. Then this article is for you.

The story

Like any other aspiring developer, I bought many domain names for many projects that I started and never finished. Last month I decided to continue one of them. I got to the phase where I deployed it to AWS 🤯, so I needed the domain name to point to my service. I used Route 53 for that. I created the records and everything. Then I requested a certificate for the domain so I could use SSL. Nothing worked 🤷‍️.

The certificate was still not issued after a whole day. The domain didn't point to my load balancer. And the SES domain verification was pending too. Usually these things don't take that long, so clearly something was wrong.

Enlarge

So I asked myself, and Stack Overflow, why the certificate and the SES verification were taking so long. None of the proposed solutions helped. So I started over. I deleted the hosted zone and all the requests, and created everything again. It still didn't work.

At this point I went to the AWS documentation for Route 53. One sentence caught my eye:

Name servers: Route 53 assigns name servers when you create a hosted zone. The assigned name servers can't be changed. To make Route 53 the DNS service for a domain (to use the records in a public hosted zone to route traffic on the internet for a domain), you update the domain registration to use these name servers.

AWS Route 53 documentation

I never changed the name servers myself, so I didn't suspect them. I thought it was some AWS hiccup. But when I compared the name servers of my domain with the "assigned name servers" of the hosted zone, they were not the same. Every time you delete and recreate a hosted zone, Route 53 assigns new name servers, but your domain keeps pointing to the old ones.

So I made them identical, then I tried the SES verification and requested the certificate again. Guess what, it worked! The certificate was issued in about 3 minutes, and SES was verified in about 1 hour.

The solution

• Go to the Route 53 hosted zones: https://console.aws.amazon.com/route53/v2/hostedzones.
• Open your hosted zone and copy the name servers listed in the hosted zone details.

Enlarge

• Then make sure your domain uses exactly these name servers. If the domain is registered in Route 53, go to Registered domains, open your domain, and edit its name servers. If it's registered somewhere else, change the name servers at that registrar.
• Also check that the NS record inside the hosted zone shows the same name servers.

Enlarge

After that, give DNS a little time to update, then request the certificate and the SES verification again.

Final words

I hope this helped you. If you had the same problem and solved it differently, tell me on X @salem_hsn.