AWS Certificate Manager and Elastic Beanstlak: Creating an SSL without domain name

3
votes

For testing purposes, would it be possible to create a certificate without a domain name? http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https.html

According to the above documentation I can, "if you don't own a domain name, you can still use HTTPS with a self-signed certificate for development and testing purposes," but I can't seem to figure out how exactly to go about doing so.

Further research tells me I can assign a SSL Certificate ID: http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-elb.html

But when I followed the directions, my dropdown for the SSL certificate ID was empty. I figured I would need to create and upload a certificate first.

I have found this documentation concerning the creation of an SSL certificate: http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-ssl.html

After following the instructions, I can't seem to upload the certificate on the EC2 instance. This is the documentation I am following to upload the SSL certification, http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-ssl-upload.html

I keep receiving this error when I try to upload it from the EC2 instance:

A client error (AccessDenied) occurred when calling the UploadServerCertificate operation: User: arn:aws:sts::172656543253:assumed-role/aws-elasticbeanstalk-ec2-role/i-62a85ce6 is not authorized to perform: iam:UploadServerCertificate on resource: arn:aws:iam::172656543253:server-certificate/elastic-beanstalk-x509

I'm guessing it has something to do with IAM roles, but I'm not entirely sure and don't really know where to begin. Any help would be appreciated. Thank you.

1
amazon-web-servicessslssl-certificateamazon-elastic-beanstalk

1 Answers

0
votes

Please see this SO answer for one way to enable https for elastic beanstalk. (In the AWS Management Console for EC2 under 'Load Balancers'-> Listeners add the certificate to be able to use it within Elastic Beanstalk.)

Now that AWS has support for ACM in all regions it's much easier to get it working because you only need to create a certificate and then reference it. ACM certificates are usually only available in the region they were issued.

Unfortunately I have nothing to add to your main question concerning SSL without a domain name.