# ViewerCertificate

Viewer certificate configuration class.

- Source: [`aws-cloudfront/lib/web-distribution.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-cloudfront/lib/web-distribution.ts#L533)
- Type last changed: v2.235.0 · 15 Jan 2026

## Example

```ts
    const s3BucketSource = new s3.Bucket(this, 'Bucket');

    const distribution = new cloudfront.CloudFrontWebDistribution(this, 'AnAmazingWebsiteProbably', {
      originConfigs: [{
        s3OriginSource: { s3BucketSource },
        behaviors: [{ isDefaultBehavior: true }],
      }],
      viewerCertificate: cloudfront.ViewerCertificate.fromIamCertificate(
        'certificateId',
        {
          aliases: ['example.com'],
          securityPolicy: cloudfront.SecurityPolicyProtocol.SSL_V3, // default
          sslMethod: cloudfront.SSLMethod.SNI, // default
        },
      ),
    });
```

## Properties

- `aliases`: string[] (required)

- `props`: [CfnDistribution.ViewerCertificateProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.CfnDistribution.ViewerCertificateProperty.html) (required)

## Methods

- `fromAcmCertificate(certificate: ICertificateRef, options?: ViewerCertificateOptions): ViewerCertificate // chainable` (static) — Generate an AWS Certificate Manager (ACM) viewer certificate configuration.

  **Parameters**

  - `certificate` — AWS Certificate Manager (ACM) certificate.
  - `options` — certificate configuration options.

- `fromCloudFrontDefaultCertificate(...aliases: string[]): ViewerCertificate // chainable` (static) — Generate a viewer certificate configuration using the CloudFront default certificate (e.g. d111111abcdef8.cloudfront.net) and a `SecurityPolicyProtocol.TLS_V1` security policy.

  **Parameters**

  - `aliases` — Alternative CNAME aliases You also must create a CNAME record with your DNS service to route queries.

- `fromIamCertificate(iamCertificateId: string, options?: ViewerCertificateOptions): ViewerCertificate // chainable` (static) — Generate an IAM viewer certificate configuration.

  **Parameters**

  - `iamCertificateId` — Identifier of the IAM certificate.
  - `options` — certificate configuration options.