I am rewriting the questions, as a result of the comments. I hope that this will increase clarity.

A while back we created with the AWS Certificate manager a public certificate which we are using to terminate the TLS traffic on our network load balancers.

enter image description here

Here the option that was selected:

enter image description here

Here an example for one of the load balancer configuration.

enter image description here

Now we would like to terminate the TLS traffic directly on an EC2 instead of the network load balancer.

When I want to export it in the UI the option for export is grayed out

enter image description here

Is there a way to export the keys or if not convert our existing domain *.xxx.com to a private certificate.

Thanks, all help is very much appreciated!

  • 1
    I'm confused. What exactly are you trying to achieve? Please tell us that rather than your idea of how you might achieve your goal. I think you have your terminology quite wrong. You will almost certainly need to create a new certificate, AWS Certificate Manager can do that for you, but you can't export the private key if you use ACM. In that case you'd need to generate your keys and certificates externally and import the certificate / keys into ACM or wherever you need them. – Tim Jun 5 '20 at 10:04
  • Are you looking for export of Private Key of your certificate to which you have a Public Key? (There’s no such thing as “Public Certificate” and “Private Certificate”) – Jozef Izso Jun 5 '20 at 10:07
  • Sorry for the confusion, I did use the terminology from the AWS console. (when requesting a certificate) What I want is to export the certificate as a pem file to use it on an EC2 machine.But I would like to use the one we already have which is not bound to any private CA but a 'public' cert. according to AWS – Oldfighter Jun 5 '20 at 12:06
  • Do you want to export certificate or private key corresponding to a certificate? – Tero Kilkanen Jun 5 '20 at 15:25
  • 1
    I still don't know what your current state is and what you're trying to achieve. I suspect you're using incorrect terminology in a way that's throwing people off. If you edit your question to generically describe the problem you may have more luck. You generally don't export keys from certificates, keys are separate. I suggest you need to really consider what you're trying to achieve, and start again with a new set of keys and certificates. – Tim Jun 6 '20 at 9:52

Certificates issued from a private CA are typically for non-standard top-level domains/non-public top-level domains that you don't own, or domains that you don't want to be made public. If you already have a public certificate from an ACM publicly trusted CA, this is not applicable.

So this question could be shortened to a sentence "can I export the certificate+private key of the existing public certificate".


"It is not possible to export public certificates whether they are ACM-issued or imported."


You don't even need a private certificate. Try to configure your EC2 server to use self signed certificate, and then the load balancer can forward traffic via HTTPS.

AWS documentation confirms that's fully supported,

You can use a self-signed certificate for the EC2 instances without issue.

External --HTTPS-->load balancer (public certificate) --HTTPS-->EC2 (self-signed certificate)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.