Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I've got a few EC2 instances acting as nodes on an ELB, and want to setup a wildcard certificate. Anyone have any good directions/links I can look into? I'm a little confused about the CSR file generation.

share|improve this question
    
No need to post a greeting or sign your posts. Just post the question itself. We all know who you are, and your acceptance of our answers is thanks enough. :) –  EEAA Apr 4 '11 at 19:44
    
Just checking: Why do you need a wildcard as opposed to a standard cert? (If you've got an ELB fronting a single service, then you might only need the latter, and they're much cheaper) –  SmallClanger Apr 5 '11 at 12:47
    
@onassar Just another suggestion but when you ask a question make sure to follow-up later and mark it as an answer, your accept rate is 25% so it doesn't provide others any incentive to answer your future questions. –  Brent Pabst Aug 9 '12 at 20:23

3 Answers 3

NOTE: Had this as comment before:

You will likely want to have the ELB pass the encrypted traffic to your EC2 instances where they can decrypt the traffic. GoDaddy has a good set of link's on how to set this up for various systems. Note, you do not have to use them for the SSL cert, but obviously the tutorial is centered on their service.

http://help.godaddy.com/topic/236/article/5537?locale=en

If you want a more technical explanation of what each file is, here are some links:

Wikipedia (technical): http://en.wikipedia.org/wiki/Transport_Layer_Security

Practical Example (Linux + Apache): http://www.akadia.com/services/ssh_test_certificate.html

share|improve this answer

You can generate the CSR with any web server you like and the process it through GoDaddy for your wildcard. Once you have it, export a PFX and use OpenSSL to extract the parts of the cert required for EC2 ELB.

http://sycure.wordpress.com/2008/05/15/tips-using-openssl-to-extract-private-key-pem-file-from-pfx-personal-information-exchange/

You will need the private, public certs.

Wildcard certs are no problem, I use several myself. They're obviously helpful if you plan on securing more than one URL under the same domain name.

Keep in mind, once you build the ELB instance, you can't change anything outside of the health checks.

Here is their doc on the matter too: http://docs.amazonwebservices.com/IAM/latest/UserGuide/index.html?InstallCert.html

share|improve this answer
1  
"Once you build the ELB instance, you can't change anything outside of the health checks" - this isn't strictly true: if you're only using the GUI then yes, but you can change the SSL certificates and adjust setting using the command line API. Although this obviously requires quite a bit more technical know-how than the command line alone. –  lxt Nov 28 '11 at 15:50

Here is what I did - For those who want to know the exact steps..

1) Generate your key. Nothing special here just make sure that your Common Name matches

openssl req -new -newkey rsa:2048 -nodes -keyout pivotal_combined_private.key -out pivotal_combined.csr

2) Get yourself a multi-domain cert 3) Convert the private key to an RSA Format

openssl rsa -in pivotal_combined_private.key -out pivotal_combined_private.rsa

4) Wait for the cert to come back...

5) Download and convert the certs to PEM format

openssl x509 -in pivotalenergysolutions.com.crt -out  input.der -outform DER
openssl x509 -in input.der -inform DER -out pivotalenergysolutions.com.pem -outform PEM
openssl x509 -in gd_bundle.crt -out  input.der -outform DER
openssl x509 -in input.der -inform DER -out gd_bundle.pem -outform PEM

6) Upload the whole thing..

iam-servercertupload -b pivotalenergysolutions.com.pem -c gd_bundle.pem -k pivotal_combined_private.rsa -s pivotalenergysolutions_combined

Hope that helps

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.