Can't use AWS cloudfront with custom SSL cert from IAM

Question

I have a CloudFront distribution that I want to setup with SSL using a custom certificate.

We want to use a SSL cert that we already have uploaded to IAM (and we're currently using for a few ELBs), but it won't let us even select the option (the drop-down where the certs are supposed to be is empty).

Any ideas? According to the official doc this is supposed to be a valid option

PS: we do not want to use an cert provided by the aws cert manager

Answer 1

Custom certificates uploaded for ELB cannot be used for CloudFront.

So you need to upload the SSL certificate (it can be the same certificate) a second time, but slightly differently.

aws iam upload-server-certificate \
  --server-certificate-name CertificateName \
  --certificate-body file://public_key_certificate_file \
  --private-key file://privatekey.pem \
  --certificate-chain file://certificate_chain_file \
  --path /cloudfront/DistributionName/

Source: https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-custom-certificate/

Note the /cloudfront/ at the start of the --path parameter.

So, in the end, you will have two certificates stored, one to be used by ELB, one to be used by CloudFront. But they can come from the same certificate source files.