fix(acm): enabled validation of certificates on the zone name (#2133)

As it is now, only certificates with subdomains are correctly validated

Got help from @njlaw to find and correct the issue

packages/@aws-cdk/aws-certificatemanager/lib/dns-validated-certificate.ts

@@ -83,7 +83,7 @@ export class DnsValidatedCertificate extends cdk.Construct implements ICertifica
     protected validate(): string[] {
         const errors: string[] = [];
         // Ensure the zone name is a parent zone of the certificate domain name
-        if (!this.domainName.endsWith('.' + this.normalizedZoneName)) {
+        if (this.domainName !== this.normalizedZoneName && !this.domainName.endsWith('.' + this.normalizedZoneName)) {
             errors.push(`DNS zone ${this.normalizedZoneName} is not authoritative for certificate domain name ${this.domainName}`);
         }
         return errors;

packages/@aws-cdk/aws-certificatemanager/test/test.dns-validated-certificate.ts

@@ -112,4 +112,31 @@ export = {
     test.throws(() => expect(stack), /DNS zone hello.com is not authoritative for certificate domain name example.com/);
     test.done();
   },
+
+  'test root certificate'(test: Test) {
+    const stack = new Stack();
+
+    const exampleDotComZone = new PublicHostedZone(stack, 'ExampleDotCom', {
+      zoneName: 'example.com'
+    });
+
+    new DnsValidatedCertificate(stack, 'Cert', {
+      domainName: 'example.com',
+      hostedZone: exampleDotComZone,
+    });
+
+    expect(stack).to(haveResource('AWS::CloudFormation::CustomResource', {
+        ServiceToken: {
+        'Fn::GetAtt': [
+          'CertCertificateRequestorFunction98FDF273',
+          'Arn'
+          ]
+        },
+        DomainName: 'example.com',
+        HostedZoneId: {
+          Ref: 'ExampleDotCom4D1B83AA'
+        }
+      }));
+    test.done();
+  },
 };