在哪里可以管理AWS中上载的IAM用户SSL证书？

Question

I uploaded a custom SSL certificate and key to use with CloudFront via the AWS CLI with an AMI user:

$ aws iam upload-server-certificate --server-certificate-name my-cert --certificate-body file://https-cert.crt --private-key file://private-key.pem

I got a json response including the certificate ID and further information. My aim was to use it as a Custom SSL Certificate (AMI user certificate or ACM certificate pruchased through AWS) but the radio button for this option remains disabled. I expected it to be active after having added the certificate to my user.

I can't find any hint what I missed or where the uploaded certificate has gone.

SOLUTION: The missing /cloudfront/ path was the key to this problem. The following command let me upload and choose a certificate in CloudFront.

aws iam upload-server-certificate --server-certificate-name my-cert --certificate-body file://https-cert.crt --certificate-chain file://ca-chain.crt --private-key file://private-key.pem --path /cloudfront/

Answer 1

CloudFront does not have access to all of your uploaded server certificates (such as certs you might upload for use with an ELB). It can only access those with a path matching /cloudfront/* .

If you are uploading a server certificate specifically for use with Amazon CloudFront distributions, you must specify a path using the --path option. The path must begin with /cloudfront and must include a trailing slash (for example, /cloudfront/test/ ).

http://docs.aws.amazon.com/cli/latest/reference/iam/upload-server-certificate.html

Uploading the certificate with a path CloudFront can see seems likely to be the part of the process you missed, since you didn't mention having done that, in the question.

Answer 2

If you supply a non-compliance custom certificate, Cloudfront just ignore them. That's why it gray out and say "no certificates available".

If you click on the link that say "learn about custom SSL", there is more info reveal. ( http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SecureConnections.html#CNAMEsAndHTTPS )

There is a section call "Requirements and Limits on Using SSL/TLS Certificates with CloudFront" . All this will tell you how to create custom certificate compliance to Cloudfront.