Domains

An environment is served at its cloud provider’s URL, such as https://abc123.execute-api.us-east-1.amazonaws.com for an app on AWS, a cloudfront.net URL for an AWS static site, or a web.app URL for a GCP static site. To serve it from your own domain, add the domain on the environment’s Domains tab in the dashboard. SKE requests a certificate for it in your cloud account and tells you which DNS records to add.

Custom domains are managed in the dashboard only. The ske CLI has no domain commands.

Before you start

• Deploy the environment once. The first deploy creates the API Gateway, CloudFront distribution or Firebase Hosting site that serves it.
• On Google Cloud, an app environment needs a network linked, with its load balancer enabled; the Domains tab shows Load balancer required until it is. AWS and Firebase static-site domains need no network.

Add a domain on AWS

1. Open the environment, go to Domains, enter the domain (app.example.com, without https:// or a path) and select Add domain. It shows as provisioning while SKE requests the certificate.
2. Within a few seconds it moves to pending_validation on its own (Refresh status checks right away) and lists Add these DNS records: a CNAME that proves you control the domain. Add it at your DNS provider exactly as shown.
3. Wait for the certificate. Once the record has propagated, ACM issues it, usually within minutes and sometimes up to half an hour. The Domains tab checks the certificate each time it loads, and the status changes to issued.
4. Select Refresh status. SKE attaches the domain to the environment, and the status becomes wired. A deploy also attaches any domain whose certificate has been issued since.
5. Under Point the domain here, add the CNAME from your domain to the target shown (an execute-api hostname on AWS). This record only appears once the domain is wired.

Keep the validation CNAME in DNS. ACM uses the same record to renew the certificate before it expires. The dashboard stops showing it once the certificate is issued, so note it down when you add it. If you remove it, renewal fails and the domain stops serving HTTPS.

If an issued certificate in your AWS account already covers the domain, SKE reuses it: the domain goes straight to issued and there is no validation record to add. A certificate SKE requested for another environment is never reused.

A domain belongs to one environment of the organization. Adding one that another environment already has is refused: remove it there first.

Route 53

If the domain’s zone (its last two labels, such as example.com) is a Route 53 hosted zone in the same AWS account, SKE adds the validation record and the alias records pointing the domain at the environment itself. You only wait for the certificate, then select Refresh status.

Google Cloud compute (early access)

On Google Cloud the certificate comes from Certificate Manager and the domain is served by the network’s load balancer. The Domains tab lists two records to add: the DNS authorization CNAME and an A record pointing the domain at the load balancer’s IP address. The domain becomes wired once the certificate is issued; select Refresh status to check. The dashboard stops showing both records once the domain is wired, so note them down and keep them in DNS: the CNAME renews the certificate and the A record serves the domain.

Statuses

Status	Meaning
provisioning	Just added; SKE is requesting the certificate.
pending_validation	DNS verification or certificate provisioning is still pending.
issued	The certificate is issued. Select Refresh status to attach the domain.
attaching	Static sites only: the hosting service is attaching the domain.
wired	Attached and ready; point your DNS at the target. A static site’s domain shows as attached.
removing	Being removed.
failed	The certificate could not be issued or the domain could not be attached. The reason shows under the domain. Remove the domain and add it again.

Apex and www

example.com and www.example.com are separate domains. Add each one; AWS static-site domains share a certificate, while Firebase manages HTTPS per domain. On AWS or GCP compute, to cover every subdomain at once, add *.example.com. Firebase static sites require exact domain names and do not accept wildcards. A wildcard covers one level (app.example.com, not a.b.example.com) and not example.com itself.

For AWS, DNS allows no CNAME at a zone’s apex (example.com). Point the apex at the target with your DNS provider’s ALIAS or ANAME record, or with CNAME flattening. The dashboard says so under an apex domain. Route 53 users don’t need to do anything: SKE adds an alias record.

Cloudflare on AWS or GCP compute

The validation CNAME must be DNS only (gray cloud), or the certificate is never issued. The record that points the domain at the target can be proxied (orange cloud). If it is, set Cloudflare’s SSL/TLS mode to Full (strict).

AWS static sites (early access)

An AWS static site’s domains go on its CloudFront distribution and share one certificate, requested in us-east-1 as CloudFront requires. A site takes up to 10 custom domains. Adding or removing one requests a new certificate for the new set and updates the distribution, which takes a few minutes. SKE keeps checking on its own; Refresh status checks right away.

A domain that was already validated passes again without new records: its validation CNAME doesn’t change. Keep every domain’s validation CNAME in DNS.

GCP static sites with Firebase (early access)

Firebase Hosting manages HTTPS for each exact custom domain, without a network or load balancer. Add example.com and www.example.com separately; wildcard names such as *.example.com are refused. Each environment has its own Hosting site. The default HTTPS web.app URL stays the primary dashboard and deployment link after you attach a custom domain.

1. In Domains, enter an exact hostname and select Add domain.
2. Under Apply these DNS changes, apply every record exactly as shown. Add means create the supplied name, type and value. Remove means delete the specified conflicting record; do not add it. Firebase can provide TXT ownership records and A or AAAA records for serving the site.
3. For an apex domain, use the records Firebase supplies. The CloudFront ALIAS, ANAME and CNAME-flattening instructions above do not apply to Firebase Hosting.
4. Keep records DNS only while Firebase verifies ownership and provisions HTTPS. Check the name and value carefully if your DNS provider appends the zone automatically.
5. Select Refresh status to check progress. Managed HTTPS provisioning can take up to 24 hours. Keep the required ownership and serving records in DNS after the domain becomes attached; the Firebase DNS instructions remain visible.

When a domain fails, its row shows Google’s error or the setup prerequisite. Resolve the reported DNS or ownership problem before retrying. SKE attaches the domain to Firebase Hosting; it does not create a CloudFront CNAME target.

Remove a domain

Select the trash icon next to the domain and confirm. On Firebase Hosting, SKE removes the custom-domain attachment; remove the records you added at your DNS provider yourself.

On AWS, SKE detaches the domain, deletes the certificate it requested for it unless another domain still uses it (a certificate reused from your account is kept), and removes any Route 53 records it added. Remove the records you added at your DNS provider yourself, except a validation CNAME that another domain of the same name still uses (example.com and *.example.com share one).

Troubleshooting

If an AWS domain stays in pending_validation:

1. Check the validation CNAME’s name and value match the dashboard exactly. Some DNS providers append the zone to the name; enter it without the trailing example.com. if yours does.
2. Check it has propagated: dig CNAME _abc123.app.example.com.
3. On Cloudflare, make sure the record is DNS only.
4. Reload the Domains tab or select Refresh status to check again. ACM gives up on a certificate whose record it can’t find within 72 hours, and the domain shows failed: remove it and add it again.

An AWS static site’s domains are checked on their own for up to 24 hours. After that the domain says it stopped checking, and Refresh status starts again.

If an AWS domain is wired but doesn’t load, check the CNAME (or ALIAS) to the target from step 5 is in place: dig app.example.com.