Aws acm api access to issue certificate - amazon-web-services

I have an application with which I want to request new ACM certificate for a domain name. I want to do DNS validation for ACM to issue the cert.
I could not find reference to an API where ACM can respond with the DNS records need to be setup before issuing certificates.
How can I get the DNS records through API?

DNS records are available in the describeCertificate API.
Ref: https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeCertificate.html

Related

How to migrate from Heroku ACM to AWS Certificate Manager?

Apologies on the broad title;my question is mainly around validating domain names in AWS Certificate Manager such that I can get valid ACM going. These are currently in Heroku and need to be migrated into AWS.
The Heroku ACM will validate a custom domain and issue a certificate if the DNS for said custom domain is a CNAME to the Heroku app's main domain. For example, if I have my-heroku-app.com and I make a CNAME from example.com to that then Heroku will successfully generate a cert and I can visit https://example.com with proper TLS. This can be verified with a simple curl -Iv https://example.com which shows a certificate issued by Let's Encrypt.
Conversely the AWS Certificate Manager requires a specific CNAME record and value to be set on a domain in order for it to generate certificates for that domain. Until that happens, I do not see a way to use things like API Gateway or ELB with said domain.
Is there a way I can migrate these domain certificates into AWS Certificate Manager from Heroku, e.g. without having to go through the typical validation process for each one of them? The main Heroku app domain is one which is going to be pointed to AWS via API Gateway and at that point all of those custom domains will fail because they're not registered in AWS API + Certificate Manager.
Conversely the AWS Certificate Manager requires a specific CNAME record and value to be set on a domain in order for it to generate certificates for that domain. Until that happens, I do not see a way to use things like API Gateway or ELB with said domain.
There is absolutely nothing stopping you from creating the ACM validation CNAME records in your DNS service, to complete the creation of the certificate in ACM, while still leaving all your current DNS records in place. The ACM validation record is just a new DNS record, it doesn't replace any of your existing records, and it is only used for validation that you own the domain name, it isn't used for actual routing of any network requests.
Is there a way I can migrate these domain certificates into AWS Certificate Manager from Heroku, e.g. without having to go through the typical validation process for each one of them?
You have to go through the validation for each one, there is no getting around that. You could script it if you have a lot of them.
The main Heroku app domain is one which is going to be pointed to AWS via API Gateway and at that point all of those custom domains will fail because they're not registered in AWS API + Certificate Manager.
This is incorrect. You don't have to "register a domain to AWS Certificate Manager" in order to validate the certificate and get the certificate. ACM isn't validating that you have a domain pointing to an AWS API before it issues you the certificate. It is just validating that you own the domain name, via a new CNAME record that is only used for domain ownership validation.
I suggest you start the certificate creation process in ACM, and look at the CNAME record it asks you to create. You will see that it is totally unrelated to any of your current DNS records, and does not conflict with them.

AWS AppSync - "Certificate is Invalid" error message when trying to create custom domain

I am trying to create a custom domain in AWS AppSync and have followed the below steps,
Created an origin certificate in Cloudflare.
Imported the certificate in AWS Certificate Manager.
Trying to create a new custom domain with name api.<domain-name>.com, the ACM certificate is listed in the drop-down. But after selecting it and clicking on create, getting the error message - Certificate is invalid.
Not sure why it says so, as the certificate is already successfully imported in ACM.
Any help is much appreciated.
Here's a snapshot of the error,
Note -
All the AWS resources are in us-east-1 region.
I am able to create a custom domain for API Gateway using the same certificate.
Cloudflare Origin CA is not supported as per https://docs.aws.amazon.com/appsync/latest/devguide/http-cert-authorities.html
At this time, self-signed certificates are not supported by HTTP resolvers when using HTTPS. AWS AppSync recognizes the following Certificate Authorities when resolving SSL/TLS certificates for HTTPS:

SSL certificate for ALB on amazonaws subdomain?

I try to configure https on ALB with default amazon subdomain: some-unique-path.elb.amazonaws.com
The problem is that I can't find how to generate the ssl certificate for this domain: Amazon Certificate Manager does not allow to generate certificates for amazonaws subdomains.
Is there any way to make it without buying custom domain and configuring it for ALB?
To use ACM you must have domain which you control. From docs:
Before the Amazon certificate authority (CA) can issue a certificate for your site, AWS Certificate Manager (ACM) must verify that you own or control all of the domain names that you specified in your request.
There are some free domain providers which you could maybe use, but you have to have domain under your control. You can't use some-unique-path.elb.amazonaws.com, because this is AWS-owned domain and you have no rights to it.

How to switch certificates in AWS Certificate Manager?

I am very new to this and struggling to understand AWS.
I had a single domain foo.mydomain.com. This was registered in Route53. And there was a certificate in AWS Certificate Manager that mapped to it.
Now I have two domains foo.mydomain.com & bar.mydomain.com. I have registered the latter in Route53. And I have requrested and received a new certificate from AWS Certificate Manager. This one maps to both domains (via the "additional names" property).
How can I simply disable the old certificate and enable the new certificate?
I want the values for In use? above to be swapped.
You need to go to the services where you are utilizing these certificates (Load Balancers, CloudFront distributions or API Gateways) and change the certificate they are using there.
AWS Certificate Manager manages the SSL/TLS certificates. In general certificates are configured and consumed on the services like ALB (application load balancer), API Gateway, Virtual Machine, Cloudfront etc. If you would like to update the certificate, modify the configuration on one of the above services as applicable in your case. While changing configuration you have to choose the right certificate from ACM. Once update is successful you will see the status in ACM.
Here is an AWS documentation explains how to install/Update SSL Certificates:
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-update-certificates.html

Can I use AWS Certificate Manager certificates for API Gateway with Custom Domain Name

Can I use a certificate from AWS Certificate Manager to use it with API Gateway and my Custom Domain Name?
How do I get the certificate body, private key and chain out of the certificate from the AWS Certificate Manager?
As you saw in the forum post, it's not possible now. ACM integration is something we want to do and it's on our backlog, but I don't have an ETA for you at the moment.
ACM is now integrated with API Gateway!