(upbeat music) (typing)
- Hi, I'm Shree Jesh, a Cloud Support Engineer at the AWS
office in Sydney.
In this video, I will walk you through the steps
to upload an SSL TLS certificate to AWS iam.
So let's get started.
(gentle upbeat music) After logging into the AWS
Management Console, navigate to the ACM console.
(gentle upbeat music)
To configure an HTTPS listener on a load balancer,
or a CloudFront distribution,
you must have a SSL or TLS certificate,
we recommend that you use AWS Certificate Manager
or ACM to request a new SSL or TLS certificate,
or import a certificate obtained from a third party
certificate authority.
However, in some scenarios,
you might have to use certificate algorithms
and key sizes that aren't supported by ACM.
For example, perhaps you can't install certificates
with 4096 bit RSA keys, or elliptic curve keys,
also known as EC keys on your classic load balancer,
or application load balancer through integration with ACM.
In such cases, you must upload these certificates
to AWS iam so that you can use them with your load balancer
or CloudFront distribution.
Now, let's open a terminal and upload a 2048 bit RSA
certificate to iam.
(gentle upbeat music)
Before uploading the SSL or TLS certificate to iam,
be sure that the certificate is valid at the time of upload.
You can verify this by using open SSL command.
(gentle upbeat music)
Upload date should be between Not Before
and Not After dates.
(gentle upbeat music)
Because we can view the output of this command
in text format, we can confirm that the certificate is pem
encoded, which is a requirement to upload the certificate
to iam, if the file content is binary,
then the certificate might be either der or pkcs 12.
If so, then you must convert the certificate,
the private key and the certificate chain
so that they are pem encoded.
To convert the der to pem use the command
openssl x509 -inform der -in certificate.cer
- out certificate.pem,
to convert pkcs 12 also known as pfx to pem,
use the command openssl pkcs12 -in certificate.pfx -out
certificate.cer -nodes.
Now let's perform the steps to upload a certificate to iam.
As you can see, I have three files here, ca_bundle.crt,
cerificate.crt and private.key,
certificate.crt is the public key
and ca_bundle.crt has the root
and intermediate certificates
ca_bundle is also known as the certificate chain.
Be sure that the certificates inside ca_bundle
or the certificate chain are in the correct order
starting with the certificate that is generated
by your certificate authority and ending
with your certificate authority's root certificate,
each of the certificates except for the first one
must directly certify the one preceding it,
if an intermediate certificate is missing,
or if the certificates are not in the correct order
inside the certificate chain,
then some browsers, mobile devices, applications
and so on won't trust the SSL certificate.
To upload the certificate, run the following command.
If you don't provide file:// when specifying the path,
you will receive the error message
unable to pass the certificate.
The output now displays the certificate ID, name,
Arn and expiration date,
you can also see slash mentioned as the default path.
This is the default path for load balancer certificates.
For CloudFront certificates, specify a path
using the hyphen path option.
That path must begin with slash CloudFront.
For example, the following command.
(gentle upbeat music)
After the certificate is uploaded,
you can view all the server certificates in iam
by using this command.
(gentle upbeat music)
You can now use these certificates on a load balancer
or CloudFront distribution.
Let's go to the load balancer console
and try to apply this certificate.
Now we are back in the AWS Management Console.
Let me navigate to ALB console.
(gentle upbeat music)
Select the ALB you want to apply the certificate to,
choose listeners and then add listener.
Select HTTPS, select default action forward to
and select the target group.
For default SSL certificate, select from iam
and select ALB certificate.
(gentle upbeat music)
This ALB is now ready to listen on HTTPS Port 443
with the uploaded certificate.
Let's now go to the Amazon CloudFront console.
(gentle upbeat music)
Select the CloudFront distribution you want to apply
the certificate to.
(gentle upbeat music)
Click on Edit to update the SSL certificate.
Click on custom SSL certificate,
you can see that the certificate that was uploaded
with the path /CloudFront/ web is the only one available
for the CloudFront distribution.
Select the certificate and then choose yes edit.
The CloudFront is now ready to listen on HTTPS listener.
Thanks for watching and happy Cloud computing,
from all of us here at AWS. (upbeat music)