AWS self-signed Application Load Balancer

Question

I've created an ALB using Boto3 and want to configure that load balancer work on HTTPS (self-signed). In order to do that, I have to generate an SSL certificate with open-ssl:

openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout key.pem -out cert.pem 

Then, I've imported the certificate into AWS ACM with no problems:

When configuring the ALB listener, I don't see the certificate in the list:

What could be the problem? I've imported the certificate and configured the LB in the same region.

I've regenerated the certificates with RSA 2048, still got the same result. Moreover, it does not appear to be in the list-certificates:

---------------------- UPDATE ----------------------

Followed the above guide and it worked.

https://medium.com/@francisyzy/create-aws-elb-with-self-signed-ssl-cert-cd1c352331f

Strangely, I've succeeded in uploading the certificate into IAM using the command above:

AWS CLI:

aws iam upload-server-certificate --server-certificate-name CERT_NAME --certificate-body file://public.pem --private-key file://private.pem

Boto3:

ssl_certificate = iam_client.upload_server_certificate(
    Path = 'PATH_STRING',
    ServerCertificateName = 'CERT_NAME',
    CertificateBody = cert_body,
    PrivateKey = private_key)

Answer 1

Followed the above guide and it worked.

https://medium.com/@francisyzy/create-aws-elb-with-self-signed-ssl-cert-cd1c352331f

Strangely, I've succeeded in uploading the certificate into IAM using the command above:

AWS CLI:

aws iam upload-server-certificate --server-certificate-name CERT_NAME --certificate-body file://public.pem --private-key file://private.pem

Boto3:

ssl_certificate = iam_client.upload_server_certificate(
    Path = 'PATH_STRING',
    ServerCertificateName = 'CERT_NAME',
    CertificateBody = cert_body,
    PrivateKey = private_key)

Answer 2

It looks like you used a key algorithm to generate your cert that isn't supported by Amazon ELB.

Regenerate the cert with RSA 2048 instead of 4096 and you should be good to go.

https://aws.amazon.com/premiumsupport/knowledge-center/elb-ssl-tls-certificate-https/

Answer 3

Rather than using a self signed SSL with ACM, why not just have ACM generate the SSL for you. It won't cost anything and will work with all AWS resources.

Additionally AWS will manage auto rotation of it so you won't ever need to worry about rotating it again, plus you can guarantee that it will be recognised as secure in most browsers.

Here's a link for generating the SSL via ACM. This is the preferred way for managing SSL within AWS.