Update an SSL Certificate for a Load Balancer

To update an SSL certificate for an HTTPS load balancer

1. Sign in to the AWS Management Console and open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. On the Amazon EC2 Getting Started page, in the EC2 Dashboard pane, under NETWORK & SECURITY, click Load Balancers.

3. On the Load Balancers page, select your load balancer.

4. The bottom pane displays the details of your load balancer.

5. Click the Listeners tab.

6. Click Change in the SSL Certificate column of the certificate you want to update.

7. On the Configure SSL Certificate page, select Choose from your existing SSL Certificates to use previously uploaded SSL certificate and select the certificate from the drop-down box.

8. Or, select Upload a new SSL Certificate if you have a SSL certificate and want to uploaded it.

   Before you upload, ensure that your certificate meets the following citeria:

   • Certificates must follow the X.509 PEM format.

   • The current date must be between the certificate’s start and end date.

   • Public and private certificate files must contain only a single certificate.

   • The private key must match the public key that is in the digital server certificate.

   • The private key must be an RSA private key in PEM format, where the PEM header is BEGIN RSA PRIVATE KEY and the footer is END RSA PRIVATE KEY.

   • The private key cannot be encrypted with a password.

   • A certificate chain starts with the immediate signing certificate and is then followed by any intermediaries in order. Intermediaries that are not involved in the trust path must not be included. The trusted root certificate can be optionally included as the last certificate.

   If your certificate does not meet the criteria listed in this step, you might get an error when you upload it. Create a new SSL certificate and upload the certificate using AWS Identity and Access Management (IAM). For instructions on creating and uploading the SSL certificate, go to Creating and Uploading Server Certificates in Using AWS Identity and Access Management.

   Step through the following instructions to continue uploading your SSL certificate.

   1. Enter the name of the certificate to upload.

   2. Copy and paste the contents of the private key file (PEM-encoded) in the Private Key box.

   3. Copy and paste the contents of the public key certificate file (PEM-encoded) in the Public Key Certificate box.

   4. [Optional] Copy and paste the contents of the public key certificate chain file (PEM-encoded) in the Certificate Chain box.

      Note

      The certificate chain must be ordered such that the root certificate is the last certificate in the chain. If you use a certificate chain in a different order, you will receive an error.

      

9. Click Save.

1. If you have a SSL certificate and have uploaded it using the AWS Identity and Access Management (IAM), get the Amazon Resource Name (ARN) of your certificate and go to step 3.

2. If you have a SSL certificate and want to upload it, step through the following instructions:

   1. Check if your certificate meets the following criteria:

      • Certificates must follow the X.509 PEM format.

      • The current date must be between the certificate’s start and end date.

      • Public and private certificate files must contain only a single certificate.

      • The private key must match the public key that is in the digital server certificate.

      • The private key must be an RSA private key in PEM format, where the PEM header is BEGIN RSA PRIVATE KEY and the footer is END RSA PRIVATE KEY.

      • The private key cannot be encrypted with a password.

      • A certificate chain starts with the immediate signing certificate and is then followed by any intermediaries in order. Intermediaries that are not involved in the trust path must not be included. The trusted root certificate can be optionally included as the last certificate.

      If your certificate does not meet the criteria, you might get an error when you upload it. Create a new SSL certificate and upload the certificate using AWS Identity and Access Management (IAM). For instructions on creating and uploading the SSL certificate, go to Creating and Uploading Server Certificates in the Using AWS Identity and Access Management.

      If your certificate meets the criteria, step through the following instructions to continue uploading your SSL certificate.

   2. Call the AWS Identity and Access Management UploadServerCertificate API with the following parameters:

      • ServerCertificateName = newCert

        Important

        You cannot use the name of the expired certificate. You must use a new name for the ServerCertificateName parameter.

      • CertificateBody = <encoded certificate body>

      • PrivateKey = <encoded private key>

      • CertificateChain = <concatenation of the encoded public key certificates>

        Note

        CertificateChain is optional. If you are using CertificateChain, then you must order the certificates such that the root certificate is the last certificate in the chain. If you use a certificate chain in a different order, you will receive an error.

      • Path = /

        Note

        Path is optional. If it is not included, the path defaults to /. For more information about paths, go to Identifiers for IAM Entities in Using AWS Identity and Access Management.

      The response includes an Amazon Resource Name (ARN) for your new certificate. Use this new ARN for the SSLCertificateId parameter in the next step.

3. Call SetLoadBalancerListenerSSLCertificate to replace the expired certificate with the new one.

   • LoadBalancerName = test-lb

   • LoadBalancerPort = 443

   • SSLCertificateId = arn:aws:iam::322191361670:server-certificate/newCert

To update an SSL certificate for an HTTPS load balancer

1. If you have a SSL certificate and have uploaded it using the AWS Identity and Access Management (IAM), get the Amazon Resource Name (ARN) of your certificate and go to step 3.

2. If you have a SSL certificate and want to upload it using AWS Identity and Access management (IAM), step through the following instructions:

   1. Check if your certificate meets the following criteria:

      • Certificates must follow the X.509 PEM format.

      • The current date must be between the certificate’s start and end date.

      • Public and private certificate files must contain only a single certificate.

      • The private key must match the public key that is in the digital server certificate.

      • The private key must be an RSA private key in PEM format, where the PEM header is BEGIN RSA PRIVATE KEY and the footer is END RSA PRIVATE KEY.

      • The private key cannot be encrypted with a password.

      • A certificate chain starts with the immediate signing certificate and is then followed by any intermediaries in order. Intermediaries that are not involved in the trust path must not be included. The trusted root certificate can be optionally included as the last certificate.

      If your certificate does not meet the criteria, you might get an error when you upload it. Create a new SSL certificate and upload the certificate using AWS Identity and Access Management (IAM). For instructions on creating and uploading the SSL certificate, go to Creating and Uploading Server Certificates in Using AWS Identity and Access Management.

      If your certificate meets the criteria, step through the following instructions to continue uploading your SSL certificate.

   2. Enter the IAM command iam-servercertupload in verbose mode to upload your certificate to the AWS IAM service.

      Important

      You cannot use the name of the expired certificate. You must use a new name for the certificate.

      PROMPT> iam-servercertupload -b /tmp/newCert.pem -k /tmp/test-pri-key.pem -s newCert [-c <concatenation of the encoded public key certificates>] -v

      Note

      -c is optional. If you are using -c, then you must order the certificates such that the root certificate is the last certificate in the chain. If you use a certificate chain in a different order, you will receive an error.

      The response includes the server certificate Amazon Resource Name (ARN) and GUID.

      arn:aws:iam::322191361670:server-certificate/testCertASCACexampleKEZUQ4K	

   3. Copy the ARN for the next step.

3. Enter the command elb-set-lb-listener-ssl-cert with an HTTPS listener, as in the following example.

   PROMPT> elb-set-lb-listener-ssl-cert  test-lb --lb-port 443 --cert-id arn:aws:iam::322191361670:server-certificate/newCert