DnsValidatedCertificate reports DNS zone example.com to be non-authoritative

When requesting a DnsValidatedCertificate using an imported HostedZone (imported with HostedZoneProvider.findAndImport) not previously saved in cdk.context.json, validation fails with error DNS zone example.com is not authoritative for certificate domain name cdn.mydomain.com

Same error is present when requesting the certificate for the root domain name:

new DnsValidatedCertificate(stack, 'MyCertificate', {
    domainName: 'mydomain.com',
    hostedZone,
});

results in: DNS zone mydomain.com is not authoritative for certificate domain name mydomain.com

[rpanfili]

I found, as a workaround, that if the hosted zone reference is still unresolved and contains the dummy values (example.com) you can simply return and wait for the next AppStack synth iteration when cdk will use the HostedZoneContextProviderPlugin to get real values from your account.

Take a look here: https://github.com/awslabs/aws-cdk/blob/23a143ea34a1654af24bf8c58f73da26136d039e/packages/aws-cdk/lib/api/cxapp/stacks.ts#L205-L207

So a working (boilerplate) solution is:

  const domainName = "foobar.com";

  const zone = new HostedZoneProvider(this, {
    domainName
  }).findAndImport(this, "HostedZone");
  if (zone.zoneName == 'example.com') {
    return;
  }
  const certificate = new DnsValidatedCertificate(this, 'ApiSSLCertificate', {
    domainName,
    hostedZone: zone
  });

Warning: Obviously the given domainName hosted zone should exists in your account otherwise you will get an error like this

Found zones: [] for dns:foobar.com, privateZone:undefined, vpcId:undefined, but wanted exactly 1 zone

[stefanorg]

I’ve the same problem, anyone found a solution?