Adding AWS SSL to an external DNS - amazon-web-services

I have bought a domain from an external resource and I tried to add the AWS SSL certificate into DNS as a CNAME record
Although the AWS Certivicate Name starts with a ' _ ' character, when I tried to add it in DNS it gives me an error as
"Server name can be use letters hypens and dots only"
I do not have any experience regarding this and want to know if I'm doing anything wrong in DNS Validation for AWS SSL Certificate.

There are couple of options to solve this:
1. Use Email verification method to get the certificate, if you haven't enabled Privacy protection on the registrar, you'll get a verification email from AWS ACM and you can verify a certificate or ACM also sends verification emails to 5 different email addresses such as:
administrator#your_domain_name
hostmaster#your_domain_name
postmaster#your_domain_name
webmaster#your_domain_name
admin#your_domain_name
Use Route53, Create a HostedZone for your domain in Route53 and use the name servers Route53 provided and use it on your current registrar.
Create and transfer all the records to Route53 , you don't need to transfer the domain, just use Route53 nameservers to your current registrar.

Related

How to migrate from Heroku ACM to AWS Certificate Manager?

Apologies on the broad title;my question is mainly around validating domain names in AWS Certificate Manager such that I can get valid ACM going. These are currently in Heroku and need to be migrated into AWS.
The Heroku ACM will validate a custom domain and issue a certificate if the DNS for said custom domain is a CNAME to the Heroku app's main domain. For example, if I have my-heroku-app.com and I make a CNAME from example.com to that then Heroku will successfully generate a cert and I can visit https://example.com with proper TLS. This can be verified with a simple curl -Iv https://example.com which shows a certificate issued by Let's Encrypt.
Conversely the AWS Certificate Manager requires a specific CNAME record and value to be set on a domain in order for it to generate certificates for that domain. Until that happens, I do not see a way to use things like API Gateway or ELB with said domain.
Is there a way I can migrate these domain certificates into AWS Certificate Manager from Heroku, e.g. without having to go through the typical validation process for each one of them? The main Heroku app domain is one which is going to be pointed to AWS via API Gateway and at that point all of those custom domains will fail because they're not registered in AWS API + Certificate Manager.
Conversely the AWS Certificate Manager requires a specific CNAME record and value to be set on a domain in order for it to generate certificates for that domain. Until that happens, I do not see a way to use things like API Gateway or ELB with said domain.
There is absolutely nothing stopping you from creating the ACM validation CNAME records in your DNS service, to complete the creation of the certificate in ACM, while still leaving all your current DNS records in place. The ACM validation record is just a new DNS record, it doesn't replace any of your existing records, and it is only used for validation that you own the domain name, it isn't used for actual routing of any network requests.
Is there a way I can migrate these domain certificates into AWS Certificate Manager from Heroku, e.g. without having to go through the typical validation process for each one of them?
You have to go through the validation for each one, there is no getting around that. You could script it if you have a lot of them.
The main Heroku app domain is one which is going to be pointed to AWS via API Gateway and at that point all of those custom domains will fail because they're not registered in AWS API + Certificate Manager.
This is incorrect. You don't have to "register a domain to AWS Certificate Manager" in order to validate the certificate and get the certificate. ACM isn't validating that you have a domain pointing to an AWS API before it issues you the certificate. It is just validating that you own the domain name, via a new CNAME record that is only used for domain ownership validation.
I suggest you start the certificate creation process in ACM, and look at the CNAME record it asks you to create. You will see that it is totally unrelated to any of your current DNS records, and does not conflict with them.

Issue AWS certificate for a single subdomain to be used with CloudFront?

My client has a domain example.com hosted somewhere.
We need to create a subdomain cloudfront.example.com in my AWS cloud in order to make my Cloudfront Distribution accessible on that subdomain.
CF requires an SSL certificate to work with a custom domain.
I was only able to find a solution which leads to 4th level subdomains via creating an AWS Hosted Zone (3rd level domain) in my AWS account where I can then create another subdomain (4th level).
Is it possible to register a single record in my client's DNS table to point to my CF Distro?
Yes, you can use the client's DNS. What you need to do:
Use ACM to create an SSL certificate for cloudfront.example.com. You will see a necessary CNAME to confirm the SSL certificate
Add CNAME to your client's DNS that will validate the certificate
In CloudFront, define alternate domain name (CNAME) as cloudfront.example.com
In the client's DNS add a CNAME for cloudfront.example.com to point to your CloudFront distribution domain name (it's going to be some-hash.cloudfront.net)

Aws ACM - how does the verification of SSL cert in DNS work

Let's say I have created a public SSL cert in ACM and choose DNS validation.
After that, I will use this SSL cert in my Cloudfront Distribution.
I have just a fundamental knowledge of How DNS Server works.
From AWS.
The Domain Name System (DNS) is a directory service for resources connected to a network. On the internet, DNS servers are used primarily to translate from domain names to the numerical IP addresses that identify and locate resources such as computers and other devices. The databases on DNS servers contain domain records that are used for this translation and to enable other functionality. For example, A records are a type of DNS record used to map domain names to IPV4 addresses. MX records are used to route email. NS records list all of the name servers for the domain.
ACM uses CNAME (Canonical Name) records to validate that you own or control a domain. When you choose DNS validation, ACM provides you one or more CNAME records to insert into your DNS database. For example, if you request a certificate for the example.com domain with www.example.com as an additional name, ACM creates two CNAME records for you.
After the certificate request is sent, I need to add the DNS configuration of this cert in my DNS Record in order to verify the cert.
I am not sure what this step serves as.
What is the purpose of this step?
What will happen if I add this DNS configuration in other people's DNS record instead of mine?
Update
1.)
Sorry I know it seems a stupid question.
According to the comment, below situation would never happen?
my DNS Record
www.MyDomain.com. A 123.120.110.1
Tom DNS Record
www.TomDomain.com. A 123.120.110.1
2.)
Let's assume I help a client for the revamp of website ABC(domain name: https://example.com)
The client want to use the same domain name of website ABC.
After I finish the website, I created SSL certificate for the example.com and created a Cloudfront distribution for the build files.
The steps I should perform then:
a) provide the DNS configuration file obtained from SSL cert in ACM to client and let them add to their DNS Record.
b) add the SSL cert in my cloudfront Distribution.
c) the client add a CNAME record for https://example.com to point to cloudfront distribution domain name(d8abcbdbwbd.cloudfront.net etc)
Is it correct?
3.)
There is a SSL cert for domain myDomain.com.
my DNS Record
www.MyDomain.com. A 123.120.110.1
Tom DNS Record
www.TomDomain.com. A 123.120.110.2
If Tom add my SSL cert in his DNS Record, error will occur in his side?
What is the purpose of this step?
Your quote explains why you have to do this: to validate that you own or control a domain.
What will happen if I add this DNS configuration in other people's DNS record instead of mine?
SSL will not be issued as validation of the domain will fail. You can only validate the SSL if you own (or control) a domain, in which case you can explicitly add CNAME records that ACM will give you to use for validation.
Update:
If you control both www.MyDomain.com and www.TomDomain.com then you can point them to the same IP. Thus, such a setup is possible.
Yes. The CNAME generated by ACM for the verification will have to be added manually. Only if you use R53 to manage your domain, it can be added automatically. Also remember that the SSL must issued in us-east-1 region.
You can have different domains on a single certificate. Thus if you register both these domains for SSL, two CNAME records will be generated for verification and you will have to add these records to their respective domain for verification.
Below is example with your two sample domains:
Since I don't control any of them, after 72h, validation expires.

How does certificate manager work for multiple domians

I'm working with certification manager, Can someone pls explain me certification manager for multiple certificates.
For example
domain_name = foo.dev
alternate_domian_names = *.foo.dev , bar.com
so should create CNAME record for all 3 domain name (foo.dev,*foo.dev and bar.com) and validate for all the 3?
For the DNS foo.dev,*.foo.dev these seem to same parent DNS so single validation will work and you will need to add bar.com so All you will need to create 2 CNAME for the above DNS validation one for foo.dev and one for bar.com.
You can also compare CNAME record for foo.com or *.foo.com it should be same that is generated by AWS ACM.
You can attach a maximum 10 Domain names for each ACM certificate by default.
Understanding Automatic Domain Validation
To validate a domain, ACM sends automated, periodic HTTPS requests to
it. For domains that start with www., ACM also sends HTTPS requests to
the parent domain. For example, if your domain is www.example.com, ACM
sends periodic requests to www.example.com and to example.com. For
domains that don't start with www., ACM also sends HTTPS requests to
www.domain. ACM treats wildcard domain names (for example, *.example.com) the same as the parent domain. For examples, see the following table.
How ACM domain validation works
Yes. I can't find documentation describing this, but at least when using DNS validation, you have to create a DNS record for each Subject Alternative Name.

how to request ACM using AWS default DNS for ELB

I have an application running on AWS ELB and want to set up https listener. I tried to request an SSL certificate using AWS ACM but was unable to do because the ELB is using default AWS DNS name.
Is it possible to request ACM for the DNS name like below?
abc-123455.us-east-2.elb.amazonaws.com
No, you can't create a certificate for a DNS name that you don't own. It is owned by AWS. What you can do is request an ACM for a DNS name that you do own like vamsi_domain.com. Then in Route53 you can use an alias (similar to CNAME) record to alias vamsi_domain.com as abc-123455.us-east-2.elb.amazonaws.com.
See the answer to this question for more information: https://serverfault.com/questions/424253/how-does-one-point-a-domain-to-a-load-balancer-that-doesnt-have-a-stable-ip
Type the name of your domain in the Domain name box and choose Next.
In this example, I type www.example.com. You must use a domain name
that you control. Requesting certificates for domains that you don’t
control violates the AWS Service Terms.
so in short, you can not use LB DNS name because you can not control LB DNS name but it controls by AWS.
easier-certificate-validation-using-dns-with-aws-certificate-manager
Now, the question is how you will validate the DNS? as AWS ACM required to validate the ownership of DNS.
You may request for the LB DNS but you will have to validate, and for validation, you need to place CNAME record in your DNS provider setting or have to use email.