CloudFront
Cloud front is a CDN web service provided by Amazon AWS.
Adding SSL Certificate to CloudFront
First of all before allowing SSL to CloudFront distributions you need to change the behavior section to redirect and enable HTTPS request to specific origins. However CloudFront by default comes with a SSL certificate which needs to be changed to include custom SSL Certificates.
Steps in Adding SSL certificate
- Prepare the Certificate and Related files
- Private key file
- Certificate file
- Certificate Chain File
- Install and Setup AWS CLI in host machine (Your Laptop) (Note: Remember to configure key value pair of a user who has IAM Change Policies permission
- Use the following command to upload SSL Certificate (Follow the Guide)
aws iam upload-server-certificate --server-certificate-name CertificateName --certificate-body file://public_key_certificate_file --private-key file://privatekey.pem --certificate-chain file://certificate_chain_file --path /cloudfront/path/
Note:
- When uploading the certificate remember to use file:// and then file names
- Remember to allow the configured user account (which is added to AWS CLI) has the attach IAM policy IAMFullAccess
- Steps: IAM -> Select user/role -> Permissions section -> Attach Policy -> Select IAMFullAccess
- When preparing Certificate Chain File Only include Intermediate and Root Certificate in Order
Common Errors
A client error (MalformedCertificate) occurred when calling the UploadServerCertific
ate operation: Unable to validate certificate chain. The certificate chain must star
t with the immediate signing certificate, followed by any intermediaries in order. T
he index within the chain of the invalid certificate is: -1
When Certificate Chain file is not in correct order
A client error (MalformedCertificate) occurred when calling the UploadServerCertific
ate operation: Unable to parse certificate. Please ensure the certificate is in PEM
format.
When 'file://' is not used in-front of file names or files are not in correct format
Worked Example
D:\CloudFrontSSL>aws iam upload-server-certificate --server-certi
ficate-name testdomain.com-20180126 --certificate-body file://web_testdomain_com.crt --priva
te-key file://private.key.rsa --certificate-chain file://Chained.crt --path /cloudfr
ont/testdomain/


