Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I've got a few EC2 instances acting as nodes on an ELB, and want to setup a wildcard certificate. Anyone have any good directions/links I can look into? I'm a little confused about the CSR file generation.

share|improve this question
No need to post a greeting or sign your posts. Just post the question itself. We all know who you are, and your acceptance of our answers is thanks enough. :) – EEAA Apr 4 '11 at 19:44
Just checking: Why do you need a wildcard as opposed to a standard cert? (If you've got an ELB fronting a single service, then you might only need the latter, and they're much cheaper) – SmallClanger Apr 5 '11 at 12:47

NOTE: Had this as comment before:

You will likely want to have the ELB pass the encrypted traffic to your EC2 instances where they can decrypt the traffic. GoDaddy has a good set of link's on how to set this up for various systems. Note, you do not have to use them for the SSL cert, but obviously the tutorial is centered on their service.

If you want a more technical explanation of what each file is, here are some links:

Wikipedia (technical):

Practical Example (Linux + Apache):

share|improve this answer

You can generate the CSR with any web server you like and the process it through GoDaddy for your wildcard. Once you have it, export a PFX and use OpenSSL to extract the parts of the cert required for EC2 ELB.

You will need the private, public certs.

Wildcard certs are no problem, I use several myself. They're obviously helpful if you plan on securing more than one URL under the same domain name.

Keep in mind, once you build the ELB instance, you can't change anything outside of the health checks.

Here is their doc on the matter too:

share|improve this answer
"Once you build the ELB instance, you can't change anything outside of the health checks" - this isn't strictly true: if you're only using the GUI then yes, but you can change the SSL certificates and adjust setting using the command line API. Although this obviously requires quite a bit more technical know-how than the command line alone. – lxt Nov 28 '11 at 15:50

Here is what I did - For those who want to know the exact steps..

1) Generate your key. Nothing special here just make sure that your Common Name matches

openssl req -new -newkey rsa:2048 -nodes -keyout pivotal_combined_private.key -out pivotal_combined.csr

2) Get yourself a multi-domain cert 3) Convert the private key to an RSA Format

openssl rsa -in pivotal_combined_private.key -out pivotal_combined_private.rsa

4) Wait for the cert to come back...

5) Download and convert the certs to PEM format

openssl x509 -in -out  input.der -outform DER
openssl x509 -in input.der -inform DER -out -outform PEM
openssl x509 -in gd_bundle.crt -out  input.der -outform DER
openssl x509 -in input.der -inform DER -out gd_bundle.pem -outform PEM

6) Upload the whole thing..

iam-servercertupload -b -c gd_bundle.pem -k pivotal_combined_private.rsa -s pivotalenergysolutions_combined

Hope that helps

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.