> ## Documentation Index
> Fetch the complete documentation index at: https://synthetiq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificates

> The two ACM certificates Synthetiq requires

Synthetiq serves all traffic over HTTPS and requires two **wildcard ACM certificates** in your AWS account. They are a prerequisite: issue them before provisioning, through whatever process you normally use for certificates. The CLI never creates them.

## What you need

The certificates cover your **base domain** — the `domain` in `_infra/synthetiq.yaml`, under which every app is served (`my-app.apps.yourcompany.com`). For `apps.yourcompany.com`:

| Certificate | Covers                                                         | Region                                 |
| ----------- | -------------------------------------------------------------- | -------------------------------------- |
| **CDN**     | `*.apps.yourcompany.com` **and** `apps.yourcompany.com` (apex) | **us-east-1** (required by CloudFront) |
| **API**     | `*.api.apps.yourcompany.com`                                   | Your infrastructure region             |

A wildcard does not cover the bare domain — request the CDN certificate with the apex as an **additional name** (in ACM: a subject alternative name). A wildcard-only certificate fails verification at `generate`.

Use **DNS validation**: ACM gives you one CNAME per certificate to create at your DNS provider — see [DNS](/docs/platform-docs/deployments/byoi/dns). Issuance completes within minutes of the records appearing, and the records also drive auto-renewal.

## Add the ARNs to your config

Once both certificates are `ISSUED`, get the ARNs into `_infra/synthetiq.yaml` any of these ways:

* Run `synthetiq infra init` with AWS credentials — it discovers issued certificates for the domain automatically.
* Pass them: `synthetiq infra init --cdn-cert-arn <arn> --api-cert-arn <arn>` (offline init prompts for them).
* Edit the `certs:` block directly.

`synthetiq infra generate` verifies both at plan time — issued, correct region, covering the required names — and fails with the specific reason if not. If you run init before the certificates exist, it stops and prints what's needed.

## Renewal

ACM auto-renews DNS-validated certificates as long as the validation CNAMEs remain in your DNS, and the ARN never changes. This is one-time setup; you won't revisit it unless you change your domain.