Problem
CloudFront rejects a custom-domain certificate with InvalidViewerCertificate. A certificate can be valid for another AWS service and still be unsuitable for the CloudFront viewer connection.
Check
For an ACM viewer certificate, inspect it in us-east-1:
aws acm describe-certificate \
--region us-east-1 \
--certificate-arn YOUR_CERTIFICATE_ARN \
--query 'Certificate.{Status:Status,Names:SubjectAlternativeNames,Expires:NotAfter}'Replace the ARN placeholder. Confirm the certificate is issued and covers the exact alternate domain name. A wildcard for *.example.com does not cover example.com or a.b.example.com.
Fix
Request or import the appropriate certificate in us-east-1 and complete validation before selecting it in CloudFront. For imported certificates, check the supported key type, chain, and expiration requirements.
Do not confuse this with an ALB origin certificate: that certificate belongs in the load balancer's Region. CloudFront viewer TLS and origin TLS are separate connections.
Verify
Save the intended certificate association and wait for the distribution to deploy. Request the custom domain over HTTPS and inspect the hostname and certificate without disabling verification.
If certificate selection succeeds but origin requests return 502, investigate the origin TLS connection separately.