title: API Gateway custom domain certificate error
body: <p>I'm trying to set up a regional API gateway with a custom domain, and I'm hitting a problem involving SSL certificates. Here's what I've done:</p>
  
  <ul>
  <li>Using ACM, created a certificate for vitalservices-3.docriot.com.</li>
  <li>In API Gateway, created a regional custom domain name--vitalservices-3.docriot.com--assigned the vitalservices-3.docriot.com certificate to it, and added a base path mapping from "/" to "vitalservices-3:prod".</li>
  <li>In the Route53 hosted zone for docriot.com, created a CNAME record mapping vitalservices-3.docriot.com to 82cgbm6s93.execute-api.us-east-1.amazonaws.com. This record has a latency-based routing policy, but it is, for now, the only record for vitalservices-3.docriot.com.</li>
  </ul>
  
  <p>When I run</p>
  
  <pre><code>curl https://82cgbm6s93.execute-api.us-east-1.amazonaws.com/prod
  </code></pre>
  
  <p>I get </p>
  
  <pre><code>{"message":"Missing Authentication Token"}
  </code></pre>
  
  <p>which is what I expect, as the API requires Cognito authentication. I get the same message when I ignore certificate errors using the "-k" option and run</p>
  
  <pre><code>curl https://vitalservices-3.docriot.com -k
  </code></pre>
  
  <p>But if I drop the -k and run </p>
  
  <pre><code>curl https://vitalservices-3.docriot.com
  </code></pre>
  
  <p>I get</p>
  
  <pre><code>curl: (60) SSL certificate problem: Invalid certificate chain . . .
  </code></pre>
  
  <p>How can I fix this?</p>
  
  <p>EDIT: I was just using curl on my OS X box because I assumed it was a simpler way of illustrating the error. I get similar behavior when I access those URLs in my Chrome browser. If enter <a href="https://vitalservices-3.docriot.com" rel="noreferrer">https://vitalservices-3.docriot.com</a>, I get the red warning triangle in the URL bar and the page saying, "Attackers might be trying to steal your information . . . ". Then, if I choose the option to view the page anyways, the browser displays a page with the text "{"message":"Missing Authentication Token"}", just as when I use "curl -k". Thus I don't think the problem is that my machine doesn't trust a certificate authority.</p>
  
  <p>I've attached a screenshot of what I see when I click "Not Secure" in the url bar and look at the certificate info.<a href="https://i.stack.imgur.com/RMmhD.png" rel="noreferrer"><img src="https://i.stack.imgur.com/RMmhD.png" alt="enter image description here"></a></p>