22

I'm am trying to set up SSL on my load balancer with a certificate I purchased from GoDaddy.

When trying to upload the certificate in the console I got an error

Failed to create load balancer: Server Certificate not found for the key: arn:aws:iam::************:server-certificate/mycert

I've never encountered this error before when adding SSL certificates. I'm not sure why iam is even used here.

After some Googling, I was able to upload my certificate to iam using aws cli (again, not sure why I had to do this).

Now when modifying the listeners I can see my uploaded certificate as an existing SSL certificate. When I try to save the my changes to the load balancer however, I get the same error. I have verified that the certificate exists:

$ aws iam list-server-certificates
{
    "ServerCertificateMetadataList": [
        {
            "ServerCertificateId": "*********************", 
            "ServerCertificateName": "mycert", 
            "Expiration": "2018-11-19T18:47:38Z", 
            "Path": "/", 
            "Arn": "arn:aws:iam::************:server-certificate/mycert", 
            "UploadDate": "2015-11-19T19:23:32Z"
        }
    ]
}

(I have verified the obfuscated account number here is the same as in the error)

From here I am stuck. Why am I not able to apply my certificate to this load balancer?


Edit Thu Nov 19 11:47:18 PST 2015

After waiting for a while and logging out and in, I was able to update the listeners with my SSL certificate. However, it doesn't seem to be working correctly. When trying to load my domain over HTTPS the request times out. It seems it unable to load the certificate

$ echo | openssl s_client -connect www.example.com:443 2>/dev/null | openssl x509 -noout -subject
unable to load certificate
69457:error:0906D06C:PEM routines:PEM_read_bio:no start line:/SourceCache/OpenSSL098/OpenSSL098-52.30.1/src/crypto/pem/pem_lib.c:648:Expecting: TRUSTED CERTIFICATE
1
  • 1
    Certs are always stored in IAM, so it sounds like you hit an IAM replication delay or another error where the cert seemed to be stored okay, but then wasn't there... what you originally should have worked. Is the ELB security group open to the world for HTTPS? If so, then you have a second anomaly here and I would suggest creating a new ELB from scratch and see if it behaves any differently. Nov 19, 2015 at 23:02

12 Answers 12

33

I faced the same problem when trying to create the ELB from the web console. I was trying to create a upload a new certificate there via GUI and it was finally failing with same error. I solved it by uploading the certificate files separately via aws cli. It is explained in this doc - http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/ssl-server-cert.html#upload-cert

Upload the certificate, private key and certificate chain like this

aws iam upload-server-certificate --server-certificate-name my-server-cert \
  --certificate-body file://my-certificate.pem --private-key file://my-private-key.pem \
  --certificate-chain file://my-certificate-chain.pem

And then go to the web console and choose the option "Choose an existing certificate from AWS Identity and Access Management (IAM)" and choose the certificate pair that was just uploaded. It will work fine after that.

9
  • 1
    I had the same problem. Solved it the way you describe, using the aws client as suggested by the link you share. Using the IAM Console web-form to paste in the key, crt and chain did NOT work for me. I installed the aws-client on my dev-machine, set it up with "aws configuration" to add credentials and then ran the command aws iam uplad-server-certificate...
    – wojjas
    Feb 5, 2016 at 12:26
  • GUI gave me issues, CLI did not ... as usual.
    – Spechal
    Mar 23, 2016 at 3:48
  • 2
    For an update (it's now 2017), I just spoke w/ Amazon support and this is STILL a known issue. The CLI is the only way to ensure that this process will work correctly. -_-
    – niczak
    Apr 18, 2017 at 19:58
  • 2
    Mid 2017 and the problem still exists.
    – Diogo Melo
    Jun 29, 2017 at 0:18
  • 2
    End of Jan 2018 - still and issue
    – Andrew S
    Jan 28, 2018 at 19:22
20

The error is misleading. It does upload the cert. Once you receive that error exit then go back to change. Choose existing IAM certificate and click on the drop down -- you should see the new cert there.

4
  • This is what happened to me, too. I got the error, assumed that mean the cert didn't upload, so I tried again... and got a different error, stating that the cert was already there. Exiting out of the "new certificate" UI and going back and choosing the cert I just uploaded as an "existing" certificate worked just fine. Mar 3, 2017 at 18:52
  • 1
    Thank you! This is so messed up. I can't believe they haven't fixed something like this.
    – naveed
    Sep 30, 2017 at 1:45
  • that is exactly correct
    – shareef
    Apr 23, 2018 at 16:41
  • This continues to happen in the ELB IAM certificate upload workflow, but they fixed it in the ALB IAM certificate upload workflow. Sep 28, 2018 at 6:48
5

I had the same issue but thankfully managed to resolve it without having to hit the CLI. I got the ELB to add a HTTPS listener by pasting the certificate chain in the public key certificate field, after the certificate itself.

The error only manifested when the certificate chain was pasted in to its own certificate chain input box in the console (marked optional). Not really sure why this made a difference but it created the HTTPS listener on the ELB and all was good.

1
  • This worked for me just now with a Comodo DV certificate bought via SSLmate. Separate issue was that I got an error right after clicking the final 'submit' button, which was fixed by re-clicking the button after a few seconds (IAM propagation delay due to eventual consistency?)
    – RichVel
    Aug 23, 2016 at 11:30
3

It was due to special character in Certificate Name: .(dot) in my case. Everything worked fine after remove all dots from certificate name

1
  • 1
    And also remove "-" dash
    – ysrb
    Dec 21, 2016 at 0:49
2

I just hit this, too. Tried five times to create a new ELB and it failed every time. Never tried to API variant, but I managed to set the SSL certificate by

  1. First creating the ELB; then
  2. modifying the listener by changing from HTTP to HTTPS and uploading my certificate+key+intermediates.
2

I faced the same problem. In my case I got the error "Server Certificate not found for the key" when uploading an SSL certificate but they eventually get uploaded and show up in the drop-down. I don't get any errors when uploading via CLI. When I contacted AWS support they gave me the below reason for the error

The reason for this happening is eventual consistency. The certificates that are uploaded are stored in IAM. Since IAM has a massive database, the uploaded certificate has to propagate through all the databases. If there is not enough time to propagate, the ELB that is trying to fetch this certificate won't be able to find it in the endpoint it is querying. Hence throws "Server Certificate not found for the key". When it eventually gets propagated, it later is able to see it as an already uploaded certificate

1

I got around this by going to the certificate manager in the aws console and uploading there first. Then using the load balancer wizard and selecting the certificate I'd uploaded.

1
  • overtime i upload SSL to AWS i run in to a different issue. This time, setting it up in Certificate Manager and then just using it in EC2 Load Balancer worked!!
    – user566245
    Sep 23, 2018 at 2:41
0

Same problem here when using the AWS web interface: I uploaded a valid certificate, correct key and the complete chain but got the above mentioned error.

I tried to uploade the certificate to another (test)-load balancer. The upload worked, but the listener status then says: "Invalid-Certificate".

When I opened the "Select certificate" dialogue again, no certificate was selected. But obviously the certificate was uploaded correctly, because I could select it in the certificat list.

So, back to my original load balancer, I tried to assign this uploaded certificate, strange thing now: it wasn't in the list. I gave it a new try and uploaded the certificate and its key but left out the certificate chain. This worked, so i knew it must be the chain, that is not correct (it's a commodo-cert). I downloaded the chain again from the official page, uploaded the whole bundle and it worked. Strange thing now: When I compared both of them - the corrupt and the new downloaded one, they seem the same. Same dates, same serial, same same. But different.

Long story short: It worked by downloading the intermediate certificates again.

0

I had this same issue and what eventually fixed it was going into the Security Group for the load balancer and making sure that port 443 was opened up.

0

Before create the Classic load balancer you need create a AMI (Image of your instance in production) With this go to the settings of creation of load balancer and do the process again and after this the certificates provided and all goings well in my case.

0

I circumvented this by not filling in the optional Certificate Chain field.

0

I had the same problem if I was uploading a certificate directly.

If I used the Certificate Manager (AWS Certificate Manager – ACM) I was able to upload the certificate. After that I could simply select the certificate within a drop down list.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .