Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

AWS: imported SSL certificate not showing up in CloudFront

I had imported a SSL certificate into AWS long time ago. It is currently installed on the ELB, and it is going to expire in 15 days. I am trying to get AWS to issue a new certificate but it is stuck waiting validation:

enter image description here

Currently Route53 is pointing to the ELB. If I enter "https://eyecloud.net.au" it works fine.

Now, I tried to create a CloudFront, so that I can redirect HTTP to HTTPS. But the imported SSL certificate does not show up:

enter image description here

I deleted the ELB, and the imported certificate becomes not in use, but it still doesn't show up on CloudFront.

like image 550
Silly Dude Avatar asked Sep 27 '17 23:09

Silly Dude


People also ask

How long does it take for SSL certificate to take effect AWS?

The certificate you requested is displayed so that you can see the status of your request. After you write the DNS record or have ACM write the record for you, it typically takes DNS 30 minutes to propagate the record, and it might take several hours for Amazon to validate it and issue the certificate.

How do I find my AWS SSL certificate?

Open the AWS Certificate Manager console at https://console.aws.amazon.com/acm/home . Expand a certificate to view its details. Find the Renewal Status in the Details section. If you don't see the status, ACM hasn't started the managed renewal process for this certificate.

Can I use self signed certificate with CloudFront?

CloudFront supports the same certificate authorities that Mozilla does. For the current list, see Mozilla Included CA Certificate List . You can't use a self-signed certificate for HTTPS communication between CloudFront and your origin.

Can I associate multiple SSL certificates with my Amazon CloudFront distribution?

You can't associate more than one SSL or Transport Layer Security (TLS) certificate to an individual CloudFront distribution. However, certificates provided by AWS Certificate Manager (ACM) support up to 10 subject alternative names, including wildcards.


1 Answers

My problem was, that I got generated a 4096 bit certificate, but Cloud Front only allows for 2048 bit certificates

CloudFront [...] with ACM support a maximum of 2048-bit RSA certificates

I created my certificate with ZeroSSL and I didn't manage to create a 2048 bit one. To do that, I installed Ubuntu on my Windows machine (needed to install the Windows Subsystem for Linux in the 'Turn Windows features on or off' section) and used Certbot for Ubuntu with this command to create a 2048 bit certificate while using dns validation:

certbot -d yourdomain -d www.yourdomain --manual --preferred-challenges dns certonly

The 4096 bit certificate didn't show up, but the new 2048 bit certificate did, after deleting the contents of the drop-down menu, like stated by @Gopgop. You can see what kind of encryption rate your certificate has when importing the certificate into AWS Certificate Manager, on the review and import page, "Public key info". If you create a new certificate with ACM, that one automatically has a 2048 bit encryption and can be used right away in Cloud Front.

like image 75
Sven Möhring Avatar answered Oct 02 '22 13:10

Sven Möhring