Repository: aws/copilot-cli

Issue:
Copilot internal certificate has too many domains.
We have a single copilot application with multiple back-end web services with each having its own alias. Unfortunately the primary certificate gets updated each time with the alias domain and we hit the 10 maximum domains in a certificate quota. We're using sub-domains so a wildcard cert would probably work here but yeah default behavior of the quota hits hard.

Discussion:
@Lou1415926: Hi @h5aaimtron ! Can you take a look at the `Parameters` tab of your environment stack, look for the parameter named `Aliases`. It should be a JSON string of format `{"service1": ["service1.alias.com"], "service2": ["service2.alias.com", "alias.com"]}`. Is any of the services listed in the JSON string a backend service?

In the meantime as I gather information from you, I am testing on my local machine as well - will share my findings!@Lou1415926: okay - I can confirm that this is a bug. When:
1. You have an app-level domain (via. `copilot app init --domain`)
2. You have imported a cert to `http.private`
3. You specify an alias for a backend service with an internal ALB in `http.alias`

The said alias shouldn't be added to the env-level certificate _that Copilot manages, "inherited" from the app-level domain. The current behavior is that that aliases, albeit we expect the users to manage the A-record & cert & validation record of it on their own, are added to the Copilot-managed certificate nevertheless. This should be the cause of what you've observed.


We will fix this bug for sure, but I also want to make sure that fixing this particular bug would unblock you completely. Can you help me confirm this:
1. Do you use `http.public.certificates` for your public alb?
2. If not, how many Load-Balanced Web Services do you have?

I will write up a workaround for you soon, that you can use before we release the fix.@Lou1415926: The workaround before the fix is released:
1. Run `copilot svc override --tool yamlpatch` and use ⬇️ as the patch. For more 
```
- op: remove
  path: /Resources/EnvControllerAction/Properties/Aliases
```

2. `copilot svc deploy` to apply the patch.
3. Repeat the above for other _backend service that has an internal alb and `http.alias` field_.


This will remove those aliases used for backend services that are behind the internal ALB from the Copilot-managed certificate. Since you must have imported an certificate for your internal ALB via. `http.private.certificates`, you must have covered those aliases in your own certificates already (otherwise the other services wouldn't have been able to reached your backend services via. https endpoint). You don't need them in the Copilot-managed certificate (whose name is env.app.domain.com)@Lou1415926: The fix is released - the `http.alias` for your backend service is no longer unnecessarily added to the certificate! After v1.32.1, you don't need the ⬆️  patch anymore.@h5aaimtron: @Lou1415926  @dannyrandall 
Hate to bring this one back to open, but using copilot 1.34.0, I'm getting the "Certificate has too many domains." again when deploying a new back-end service (already ran copilot app upgrade successfully). If I provide the override, no A record is created in route 53. The service deployed but is not reachable via the alias. This is a bit of a problem.

Solution patch:
diff --git a/internal/pkg/template/templates/workloads/partials/cf/env-controller.yml b/internal/pkg/template/templates/workloads/partials/cf/env-controller.yml
index 36bfcc8d..27e789f5 100644
--- a/internal/pkg/template/templates/workloads/partials/cf/env-controller.yml
+++ b/internal/pkg/template/templates/workloads/partials/cf/env-controller.yml
@@ -5,7 +5,7 @@ EnvControllerAction:
   Properties:
     ServiceToken: !GetAtt EnvControllerFunction.Arn
     Workload: !Ref WorkloadName
-{{- if and (and .ALBListener .ALBListener.Aliases) (not .ImportedALB) }}
+{{- if and (and .ALBListener .ALBListener.Aliases) (not .ImportedALB) (eq $.WorkloadType "Load Balanced Web Service")}}
     Aliases: {{ fmtSlice (quoteSlice .ALBListener.Aliases) }}
 {{- end}}
     EnvStack: !Sub '${AppName}-${EnvName}'



Test patch:
diff --git a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/backend/https-path-alias-template.yml b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/backend/https-path-alias-template.yml
index 768bc6b9..d6539ed7 100644
--- a/internal/pkg/deploy/cloudformation/stack/testdata/workloads/backend/https-path-alias-template.yml
+++ b/internal/pkg/deploy/cloudformation/stack/testdata/workloads/backend/https-path-alias-template.yml
@@ -427,7 +427,6 @@ Resources:
     Properties:
       ServiceToken: !GetAtt EnvControllerFunction.Arn
       Workload: !Ref WorkloadName
-      Aliases: ["example.com", "foobar.com", "*.foobar.com"]
       EnvStack: !Sub '${AppName}-${EnvName}'
       Parameters: [InternalALBWorkloads]
       EnvVersion: v1.42.0