Certificate Lifecycle Service  ·  View 04 of 21  ·  People and journeys

Journey — A Tenant Brings Their Own Domain

Five phases, one trough, and a design choice that makes the trough a one-time cost instead of a quarterly one.

Editable source SVG draw.io All views
Tenant admin one of 9,000; not a PKI expert Goal — Serve the product on support.acme-corp.com with a padlock and no ticket Trigger — Marketing wants the product on the company's own domain before launch Done when — The domain serves, and it keeps serving for years without them returning 1 · Add domain console 2 · Delegate DNS ◆ moment of truth 3 · Wait minutes 4 · Cut over ◆ moment of truth 5 · Forget it years What they do Types the hostname Copies one CNAME Pastes it at the registrar Refreshes the page Repoints the A record Nothing Where Tenant console Their DNS provider not ours Domain status page Their DNS provider Renewal email only if it fails How it feels Delighted Fine Frustrated Behind the glass Domain register Name denylist Delegation checker ACME order DNS-01 responder ACM import Edge binding Renewal scheduler Endpoint prober Where it hurts Registrar UI is theirs Propagation is opaque "Pending" with no reason HTTP-01 cannot pre-issue Silent delegation removal What answers it One hostname field One permanent CNAME Named failure reasons Issue before cutover Delegation health check User Journey — A Tenant Brings Their Own Domain CNAME delegation is a one-time act by design: every later renewal is answered inside the platform's own zone, so the trough at phase 2 is paid once rather than every 90 days. v 1.0 · owner Experience and Platform · date 2026-09

The trough, and the answer

  • Phase 2 is the only phase the platform does not control: the admin must act in their own registrar's UI, and DNS propagation is opaque to both sides.
  • CNAME delegation is chosen precisely because it makes that phase happen once. Every renewal for the life of the domain is answered inside the platform's own zone.
  • HTTP-01 is offered as a fallback with the trade-off stated: it cannot complete before traffic is already arriving, so it cannot pre-issue for a cutover.

Targets

  • Delegation created to padlock serving: ≤ 15 minutes p95, with no support interaction (stated assumption).
  • Every validation failure carries a named reason the tenant can act on; "pending" with no reason is treated as a product defect.

Risk

  • Silent delegation removal at phase 5 — the tenant repoints or churns, and renewal fails months later. Answered by a standing delegation health check and a bounded retire schedule rather than indefinite retry.
◀  Actors and Their Core Journeys All views Journey — The Expiry That Did Not Happen  ▶
Solution Architecture v1.0 · Amazon Web Services · Security Platform Architecture · 2026-09 · 21 views · 20 architecture decision records04-journey-bring-a-domain