title: AWS CDK Python - Certificate Manager DNS Validation with Route53
body: <p>I have been trying to set up DNS Certificate Validation using CDK in Python.</p>
  <p>My code looks like this:</p>
  <pre class="lang-py prettyprint-override"><code>class ApiService(core.Construct):
    def __init__(self, scope: core.Construct, id: str, env: str) -&gt; None:
  # set up hosted zone for existing Domain in Route53
      hosted_zone = aws_route53.HostedZone(self, &quot;devHostedZone&quot;, zone_name=&quot;example.com&quot;)
  # Create validation from DNS with hosted zone
      cert_validation = CertificateValidation.from_dns(hosted_zone)
      subj_alt_names = ['example.com', '*.example.com']
  # DNS Validated certificate in zone, for domain and alternate names in specified region (for edge enabled APIs)
      cert_dns_val = DnsValidatedCertificate(
        self,
        'DnsValidation',
        hosted_zone=hosted_zone,
        domain_name='example.com',
        subject_alternative_names=subj_alt_names,
        region='us-east-1', 
        validation=cert_validation)
  # Set up the gateway with domain name settings
      api = apigateway.RestApi(
        self, 
        &quot;My-api&quot;, 
        rest_api_name=&quot;My API&quot;, 
        description=&quot;A Lambda that contains the REST API for My API.&quot;, 
        domain_name=apigateway.DomainNameOptions(certificate=cert_dns_val, domain_name=env+&quot;.example.com&quot;)
        )
  # Finally create A Record to route incoming requests internally to the API Gateway that was just created
      target = aws_route53.RecordTarget.from_alias(alias.ApiGateway(api))
      record = ARecord(self, 'ARecord', target=target, zone=hosted_zone, record_name=env+&quot;.example.com&quot;)
  </code></pre>
  <p>The problem that I can not seem to get my head around is</p>
  <ol>
  <li>how I can tell AWS through CDK to set up the required DNS CNAME records in order to validate the Certificate and</li>
  <li>How I can set it to TLS 1.2 by default (not TLS 1.0)</li>
  </ol>
  <p>The issue I see using this:</p>
  <ol>
  <li>there are 3 certificates generated in the ACM (AWS Certificate Manager) in the console.
  -&gt; this is wrong, it should only produce a single one</li>
  <li>CDK does not seem to add the CNAME record automatically, so I tried adding it manually whilst CloudFormation is in progress. However, that did not work either.</li>
  </ol>
  <p><a href="https://i.stack.imgur.com/jZy6F.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/jZy6F.png" alt="enter image description here" /></a></p>
  <p>Its important to add that all 6 generated CNAME Records are identical, so it will always only require a single CNAME record in the hosted zone config in Route53 (which I set, but did not seem to make a difference)</p>