I have cert.pfx file, I need to install to be used in Amazon Elastic Load Balancer. How can I do it?
-
Rather sounds like a question that your favourite search enginge will answer (or aws docs/customer support)– m02ph3u5Mar 22, 2016 at 14:58
-
4@m02ph3u5 Because it's QA style question, and I spent over two days on getting a clear and working answer which is below.– snowindyMar 22, 2016 at 16:32
3 Answers
- Extract private key without password. First command will request
pfx
password and prompt for a password forkey.pem
; a password forkey.pem
must be provided. Second command asks forkey.pem
password provided for 1st command.
openssl pkcs12 -in cert.pfx -nocerts -out key.pem
openssl rsa -in key.pem -out server.key
- Extract certificate:
openssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.pem
- Extract certificate chain:
openssl pkcs12 -in cert.pfx -nodes -nokeys -out chain.pem
Certificate chain contains several items. You may need to remove item that refers to your certificate, it's on top and it's not needed. Give a try with/without removing top item. After that the other items should be placed in reverse order.
server.key is private key in ELB, cert.pem is certificate in ELB, output #4 is certificate chain.
Good luck!
-
Really make sure you provide a password for key.pem - it doesn't complain if you don't so you end up with a broken file. Sep 30, 2019 at 5:07
-
Sometimes the cert does not contain the intermediate CA certs, and the chain.pem is empty in that case. And AWS does not accept such thing. I found a solution via this article: chadstechnoworks.com/wptech/os/… Aug 18, 2020 at 13:12
you can easily convert the format of the certificate using the OpenSSL suite.
The process is very easy and a good guide is here: http://www.petefreitag.com/item/16.cfm.
About the different steps (taken from the link I reported above):
# Export the private key file from the pfx file
openssl pkcs12 -in filename.pfx -nocerts -out key.pem
# Export the certificate file from the pfx file
openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem
# This removes the passphrase from the private key so Apache won't
# prompt you for your passphase when it starts
openssl rsa -in key.pem -out server.key
Now, if you have a linux distro, it is straight forward to install openSSL (yum install openssl on an rpm based distro).
If you don't have a linux distro installed, then the quickest would be to go for a live distribution (I personally love fedora https://getfedora.org/)
I hope this helps
-
What cad do a man to get some more karma on SO? Even not read the question at all, which is specific to Amazon ELB SSL.– snowindyMar 22, 2016 at 16:35
-
Actually I just wanted to help. Didn't see that the previous response was from you. My advice is to close and accept your response so that your (incomplete question) won't pop-up again in the list Have a good day Mar 23, 2016 at 9:07
-
I would happily mark mine as answer if SO allow me to do it. Actually I can't do it for 48h since question posting, even if it's Q/A style. Thanks anyway.– snowindyMar 23, 2016 at 11:25
First go to Certificate Manager and import your certificate [cert, key, chain], then create AWS LB with existing certificate.
-
2He doesn't have a cert, key, and chain. He has a single file, *.pfx. He is mostly complaining (legitimately) that AWS doesn't allow you to import a pfx file like seemingly every other place allows you to do. Oct 30, 2017 at 13:52