DNS and certificates

In 1 minute

DNS turns a name into an address. Our domain, minitickets.theversehub.in, lives at Cloudflare, not in AWS, so Pulumi prints the records and a person adds them. The main record is a CNAME (an alias) to the load balancer’s own DNS name. The HTTPS certificate comes from ACM (AWS Certificate Manager), which issues it only after it finds a validation record in our DNS.

Picture it

flowchart TB
  B[Browser] -->|"1. look up name"| CF["Cloudflare DNS"]
  CF -->|"CNAME"| ALBDNS["ALB DNS name"]
  B -->|"2. HTTPS"| ALB["ALB :443"]
  ACM["ACM certificate"] --> ALB
  ACM -.->|"checks validation CNAME"| CF

How it works

1. Look-up. The browser asks DNS for minitickets.theversehub.in. Cloudflare answers with a CNAME to the ALB’s AWS name, which resolves to its current IPs.
2. Validation. ACM asks us to add a special CNAME record. When ACM sees it, it knows we control the domain and issues the certificate.
3. HTTPS. The browser connects to the ALB on 443. The ALB shows the certificate; the browser checks it matches the name and is signed by a trusted authority.
4. Renewal. ACM renews the certificate by itself, as long as the validation record stays in DNS.

In MiniTickets

The certificate covers exactly one name, no wildcard (infra/src/certificate.ts → createCertificate). It is always on when domainName is set, so it is already issued on deploy day. Before the HTTPS listener is created, Pulumi waits up to 10 minutes for status ISSUED.

Cloudflare holds four kinds of records for us: the app CNAME, the ACM validation CNAME and three SES DKIM CNAMEs for signed email. The Cloudflare proxy must be off (DNS only) for all of them.

HTTPS also matters to log-in: the session cookie is Secure, so the browser sends it only over HTTPS.

From → to	What happens	What allows it
Browser → Public DNSonly when cdnEnabled = false	looks up minitickets.theversehub.in and gets the ALB's DNS name	dns CNAME minitickets.theversehub.in → the ALB's DNS name (stack output appDnsRecord), added by hand at Cloudflare, proxy offappDnsRecord
Public DNS → ACM certificate	ACM finds its validation record and issues (and later renews) the certificate	dns validation CNAME _<random>.minitickets.theversehub.in (stack output certificateValidationRecord), kept forevercreateCertificate
SES email identities → Public DNS	receiving mail servers check the DKIM signature against our DNS	dns 3 CNAMEs <token>._domainkey.minitickets.theversehub.in → <token>.dkim.amazonses.com (stack output sesDkimRecords)createEmail

See the DNS on the map →

See it in AWS

Console

Certificate Manager → Certificates → minitickets.theversehub.in → Status, and Domains (the CNAME name and value).

CLI

aws acm list-certificates --certificate-statuses ISSUED PENDING_VALIDATION

Code

The records Pulumi prints: infra/index.ts → appDnsRecord.

Break it

Symptom	Cause	Where to look
The domain shows a DNS error after a redeploy	The CNAME still points at a deleted ALB	Cloudflare record vs albDnsName output
The deploy waits 10 minutes, then fails	Validation CNAME missing, status PENDING_VALIDATION	ACM → the certificate
Certificate or DKIM never validates	The record is proxied in Cloudflare	Proxy status must be DNS only

Say it in an interview

Say it like this (20-30 seconds)

DNS is at Cloudflare. The app name is a CNAME to the ALB’s DNS name, and Pulumi prints the records for a person to add, because Pulumi does not manage Cloudflare here. The certificate is a free ACM certificate for that one name, DNS-validated with a CNAME, so it renews automatically. The ALB’s HTTPS listener uses it. The trade-off: a new ALB gets a new DNS name, so the CNAME must be updated.

Follow-ups

Why a CNAME and not the ALB's IP address?

An ALB’s IPs change as AWS scales it. Its DNS name stays the same for the life of the ALB, so pointing a CNAME at it is the stable choice.

What would Route 53 change?

An alias record could point the bare domain at the ALB, and Pulumi could create every record itself. The manual step, and the stale-CNAME risk after a redeploy, would disappear.

Why must the certificate be in us-east-1?

An ALB can only use a certificate from its own region, and ours is in us-east-1. CloudFront also requires us-east-1 for its certificates.

Advanced: What switching entry off and on does

Switching entryEnabled off deletes the ALB. Switching it on creates a new one with a new DNS name. The certificate survives (it is not behind the switch), but the app CNAME at Cloudflare must be updated to the new name: pulumi stack output appDnsRecord prints it.

Checkpoint

Answer these without scrolling up. If one feels hard, reread that section.

1. What does the app’s DNS record point at, and why not an IP?
2. How does ACM know we own the domain?
3. Which records does Cloudflare hold for MiniTickets?
4. What breaks after the ALB is recreated?
5. Why does log-in need HTTPS?

Redraw it from memory: browser → Cloudflare (CNAME) → ALB, and ACM checking its validation record

Try this: run dig +short CNAME minitickets.theversehub.in and compare it with the ALB's DNS name in the console

Mark this page as read