Amazon Web Services offers hosting instances suitable for hosting both general servers and applications, as well as certain additional services. Consequently, there are various options available for installing an SSL certificate on AWS.
This article outlines the steps to install your SSL certificate on several specific Amazon-related applications or services.
Some prerequisite information
For SSL installation you generally need three components: a certificate, an intermediate certificate chain (CA-bundle) and a Private key.
- វិញ្ញាបនបត្រ SSL are sent as a PEM-formatted file with a .crt extension. If the extensions are not shown in your system by default for all files, an SSL will have “Security certificate” in the file description. The same file can be also downloaded ផ្លូវនេះ.
Inside the file there is a code like this:
- An Intermediate certificate chain (CA-bundle) is also sent in a PEM-format file, but this file has a .ca-bundle extension. Inside the file, there are normally one or two codes similar to the certificate. The CA-bundle, as with the certificate, is usually in the SSL archive you receive after SSL activation.
- A កូនសោឯកជន is generated along with the certificate signing request (CSR) used to activate your SSL. If you generated the CSR on your server, the key is saved in the same place. It has .គន្លឹះ ផ្នែកបន្ថែម។
It contains a code like this:
On your server, the content of the files can be checked using the cat command (specify the actual file name in your command):
cat example.crt
On a local machine, you can right-click on the file, select បើកជាមួយ, and choose any plain text editor.
The aforementioned SSL components will sometimes need to be uploaded as files or uploaded as codes, depending on the particular Amazon service you use.
Elastic Compute Cloud (EC2)
If you have EC2, it generally means that a separate web, mail or application server is installed, and the SSL should be installed on that server. For more information on installing SSL certificates, you can refer to instructions នៅទីនេះ.
Things will differ slightly if you use the Amazon Linux AMI.
Amazon Linux is a specific Linux distribution provided by Amazon. It is normally based on CentOS Linux with the Apache server installed (though a Debian-based version also exists).
On Amazon Linux 2, the installation process is exactly the same as normal SSL installation on the Apache server on CentOS.
For other versions of Amazon Linux, there is one peculiarity. To run an encrypted HTTPS connection on an Apache web server, mod_ssl needs to be installed with the help of a slightly different command to the one usually used on Apache:
sudo yum install -y mod24_ssl
The default SSL configuration file location on Linux AMI is /etc/httpd/conf.d/ssl.conf. All the changes required to install an SSL can be made within this file.
Elastic Load Balancer (ELB)
A load balancer is a specific service that allows the managing of traffic across several hosting instances. Amazon provides a load balancer service that can be secured with an SSL certificate.
អ្នកអាចធ្វើបាន upload the SSL directly through the graphic interface to AWS certificate manager (ACM) (1) ឬធ្វើវា through the command line in the AWS Identity & Access Management (IAM) (2).
- The first option is pretty simple. During the Load balancer creation you can import the new certificate in the second step of the setup:
Simply choose to upload the certificate to ACM (this option sets a default SSL for all unassigned cases) or IAM (this one allows you to add multiple SSLs) and paste all 3 SSL components as codes:
- នេះ វិញ្ញាបនប័ត្រ in the “Certificate body” form;
- CA-bundle in the “Certificate chain” form;
- និង កូនសោឯកជន in the “Private key” form.
Choose the security policy from the drop-down list (the default one will work just fine) and proceed with the load balancer setup.
The SSL can be also added later by going to the ផ្ទុកតុល្យភាព menu >> អ្នកស្តាប់ >> View/edit certificates.
Click on the + (plus) button to add a new certificate and open the វិញ្ញាបនបត្រនាំចូល បន្ទះ។
The form for SSL upload will show:
- សម្រាប់ ជម្រើសទីពីរ, upload the certificate, Private key and CA Bundle to your server and open the command line. All three files can be installed using a single command:
aws iam upload-server-certificate –server-certificate-name certificate_object_name –certificate-body file://*path to your certificate file* –private-key file://*path to your private key file* –certificate-chain file://*path to your CA-bundle file*
ចំណាំ: When you specify a file as a parameter (for example, for the certificate-body និង private-key parameters), file:// should be included as a part of the file name.
ចំណាំ: នេះ certificate_object_name parameter is used to assign your own name to the certificate so that you can identify it further.
When you upload your certificate files, IAM will validate the files if the following criteria are met:
- Certificates should be in X.509 PEM format.
- The current date should be between the certificate’s issuance and expiration date.
- The certificate and Private key files should contain only a single item, meaning one certificate file and one corresponding key.
- The Private key should match the certificate.
- The Private key should be in PEM format, just like the certificate is. The correct format of the text within the key file should begin with —–BEGIN RSA PRIVATE KEY—– and ends with —–END RSA PRIVATE KEY—–.
- The Private key should not be encrypted with a password.
Once the files are uploaded, you can verify the certificate information in the IAM store by using the following command:
aws iam get-server-certificate –server-certificate-name certificate_object_name
លទ្ធផលគួរតែមើលទៅដូចនេះ:
arn:aws:iam::Your_AWS_Account_ID:server-certificate/Your_Certificate_Object_Name Certificate_Object_GUID
Your_AWS_Account_ID is a unique Amazon Resource Name (ARN) and Certificate_Object_GUID is the ID of the certificate.
នេះជាឧទាហរណ៍មួយ:
arn:aws:iam::123456789012:server-certificate/certificate_object_name ADGTHexampleLKBASAH
Digits in the first line are the ARN, and the second line is the certificate ID.
- ប្រសិនបើអ្នកត្រូវការ ធ្វើឱ្យទាន់សម័យ the certificate for a HTTPS load balancer, you will need to use the ARN of the certificate. The following command is used in such a case to set the certificate for the load balancer:
aws elb set-load-balancer-listener-ssl-certificate –load-balancer-name my-loadbalancer –load-balancer-port 443 –ssl-certificate-id arn:aws:iam::123456789012:server-certificate/certificate_object_name
Parameter my-loadbalancer is the name of your load balancer.
For more details about creating a HTTPS load balancer and setting its name, please check the following guide.
AWS API Gateway
By default, Amazon API uses a default access link ដែលមើលទៅដូចនេះ៖
https://api-id.execute-api.region.amazonaws.com/stage
In some cases, it’s more convenient to set up a custom hostname for it instead. The custom link can be also secured with an SSL certificate.
The process is similar to the load balancer securing.
- Log in to the AWS Certificate Manager console.
- Choose the Import a certificate option.
- A similar form for the SSL upload will open.
- Paste the certificate file code as the “Certificate body”, CA-bundle code as the “Certificate chain” and Private key code as the “Certificate private key” and click បន្ទាប់.
- Save the changes by selecting the ពិនិត្យ និងនាំចូល ជម្រើស។
- ជ្រើស ឈ្មោះដែនផ្ទាល់ខ្លួន ជម្រើសពី ច្រកទ្វារ API ។ ម៉ឺនុយ។
- Choose your custom domain name.
- ចុច Edit.
- Choose the correct SSL from the drop-down list and save the changes.
Keep in mind! The certificate may take up to 40 minutes to apply.
Alternatively, you can also install an SSL through the domainname:update API-call via the command line.
The request itself will look like this:
PATCH /domainnames/*Your API domain name*
{
“patchOperations” : [ {
“op” : replace,
“path” : *parameter used to identify the SSL*,
“value” : *parameter value*,
“from” : // optional parameter where you can specify what specific part of the application should use the SSL.
} ]
}
More details about the command can be found នៅទីនេះ.
Amazon CloudFront
Amazon CloudFront is a web service that allows you to speed up content distribution in different locations by caching some of it in a special storage.
You can either upload an SSL certificate through SSL manager or through the command line, as described above in the section “AWS API Gateway"។
After adding the SSL, CloudFront settings need to be updated as follows:
- Open your AWS console and go to the CloudFront console.
- Choose the ID of the CloudFront entity that needs to be updated.
- ចូលទៅ ទូទៅ ផ្ទាំងហើយជ្រើស Edit.
ធ្វើបច្ចុប្បន្នភាព Alternate Domain Names (CNAMEs) with your SSL domain name(s) and choose the correct SSL from the list.
5 ។ ចុច Yes, Edit.
6. After this, you can go to the អាកប្បកិរិយា tab and either set a redirect from HTTP to HTTPS or set the Cloudfront to HTTPS only.
The SSL can be set up during the CloudFront entity creation also.
ចំណាំ: If you want to use an ACM certificate with Amazon CloudFront, make sure you import a certificate stored in the US East (N. Virginia) region. Otherwise, use the certificate imported to IAM.
You can verify that a certificate has been installed correctly by checking directly or using an online checker, such as មួយនេះ.