-1

I'm very new to Amazon EC2. I am trying to setup https for my website, I follow the offical instruction from amazon doc: http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https.html

When I Upload a Signed Certificate using AWS command

aws iam upload-server-certificate --server-certificate-name dichcumga --certificate-body file://mycert.pem --private-key file://signedkey.pem --certificate-chain file://mychain.pem

And I got error

A client error (MalformedCertificate) occurred when calling the UploadServerCert ificate operation: Certificate body is invalid. The body must not contain a private key.

mycert.pem is a combination of private.pem and signedkey.pem (which return by VeriSign)

copy private.pem+signedkey.pem mycert.pem

Please help to shed a light. Thank you in advance.

[Update 1 - 08/21/2014]: Issue with public certificate returns from the CA

As suggestion of @mezi, I follow the instruction at: http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/ssl-server-cert.html

But I get the issue with public certificate returns from the CA.

  • I submit CSR request
  • CA returns me an email with the public certificate as plain text

-----BEGIN CERTIFICATE----- MIAGCSqGSIb3DQEHAqCAMIACAQExADALBgkqhkiG9w0BBwGggDCCBPYwggPeoAMC AQICED0qLOh43VCbqW0sDf5mb+swDQYJKoZIhvcNAQEFBQAwgcsxCzAJBgNVBAYT AlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEwMC4GA1UECxMnRm9yIFRlc3Qg UHVycG9zZXMgT25seS4gIE5vIGFzc3VyYW5jZXMuMUIwQAYDVQQLEzlUZXJtcyBv ZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2Nwcy90ZXN0Y2EgKGMp MDkxLTArBgNVBAMTJFZlcmlTaWduIFRyaWFsIFNlY3VyZSBTZXJ2ZXIgQ0EgLSBH MjAeFw0xNDA4MjEwMDAwMDBaFw0xNDA5MjAyMzU5NTlaMFwxCzAJBgNVBAYTAlZO MRIwEAYDVQQIEwlIb0NoaU1pbmgxEjAQBgNVBAcUCUhvQ2hpTWluaDEQMA4GA1UE ChQHRXBpbmlvbjETMBEGA1UEAxQKZGljaGN1bS5nYTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBALA9p0sxl7egvc93GUsy9i0ShGBt//9dr+nqudpAfPtP Bq4ZS/xle1YiX3zilOQ4uAduGfKpEQc1/h1Pa/ShUXhwxXvdmdOXTOEBUIHaGKKl wG3pDpFfNGIo5mf+5sPIEEHsakyp6lwBgmESELI6BnV/FuVuxvdW3T4gORXaLJsh xqW/69kO62FVP8pTcj50r4vRk5SkHos5C2zKKcCCdE/OAWyQ7rRW1bSM6SCipWQh 1xvYFqKzscAwtMYVbow17p9RWx50J3Jv8U0+je7XzgFD2O2E8bCvpaR5DVGRNbbF pdoUZA0L2liV+/hGVbsDbNxY7gCS/PoJWvsMptQfy9cCAwEAAaOCAUIwggE+MBUG A1UdEQQOMAyCCmRpY2hjdW0uZ2EwCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAw KwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NxLnN5bWNiLmNvbS9zcS5jcmwwZQYD VR0gBF4wXDBaBgpghkgBhvhFAQcVMEwwIwYIKwYBBQUHAgEWF2h0dHBzOi8vZC5z eW1jYi5jb20vY3BzMCUGCCsGAQUFBwICMBkWF2h0dHBzOi8vZC5zeW1jYi5jb20v cnBhMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBQo FxOKvdaitdwGLLe2jtoQZmBu5TA2BggrBgEFBQcBAQQqMCgwJgYIKwYBBQUHMAKG Gmh0dHA6Ly9zcS5zeW1jYi5jb20vc3EuY3J0MA0GCSqGSIb3DQEBBQUAA4IBAQDE UtCDek5Gq0Ilw+WCCD6jz+s35wxlLPvNIeIGaRky2PwnXdrAZV8iwfVmg26Nua9W JNsKlnsdiev854M7ztQv3IjArvS+fBIj5o4T9WKdQP+EUISPI2yTVqa1bu6mDZEw EhwxAGCVT4Na5EjEvD2zc/V5ukFnGK8wFFty4lY/YclOAdFIAILHb/4vOeebdWcJ X2d6+KigvcQuIqOce8MhB48DgpeEBWNZjQMr3D3jLHgs+c9QFEaHkjXFF14Kxo1r D3KaexqdyQJLH26z7hjd58TPeMvx++69m6f/oEKG63pUoF2XfRwaCIVgQohh3I2D PCxcgFJ21zCFBNKHJ3JFMIIFfDCCBGSgAwIBAgIQfju3hLvGVKvSuNZ37MOUqDAN BgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWdu LCBJbmMuMTAwLgYDVQQLEydGb3IgVGVzdCBQdXJwb3NlcyBPbmx5LiAgTm8gYXNz dXJhbmNlcy4xMjAwBgNVBAMTKVZlcmlTaWduIFRyaWFsIFNlY3VyZSBTZXJ2ZXIg Um9vdCBDQSAtIEcyMB4XDTA5MDQwMTAwMDAwMFoXDTE5MDMzMTIzNTk1OVowgcsx CzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEwMC4GA1UECxMn Rm9yIFRlc3QgUHVycG9zZXMgT25seS4gIE5vIGFzc3VyYW5jZXMuMUIwQAYDVQQL EzlUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL2Nwcy90 ZXN0Y2EgKGMpMDkxLTArBgNVBAMTJFZlcmlTaWduIFRyaWFsIFNlY3VyZSBTZXJ2 ZXIgQ0EgLSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANsTzSdP SAMzV5hTV6ImkhXRbCA760I/Fx2ZAY1ZWG+IpM47+QX5TcLW0VoOyXwJtSGOj+Zn Kr9KMmAlb/jcjM9WHzgitJzpSVKylU4dOSH2o9UjAPuq0bZA6xfNV4mzr4rggtE5 lGIyQ32AbKjqOjgEKvSVZ/061J7EDz7wRWgHY24xRUQrh4C+2y1boQfAq+s1cp4Y VDxYInIl5aNNxThQvJY7ibkJ6jEH+sNuEdEIK5g6YzwjVPbFAYu00LYusq/WgR18 misNumlMfV+tb1hwM70KMMWArVBtFkbkpLIwNpvrhLR/wY8l6tPBHkFQ4Rnwy0nB vzogCNwmWU2f6QUCAwEAAaOCAZcwggGTMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEF BQcwAYYYaHR0cDovL29jc3AudmVyaXNpZ24uY29tMBIGA1UdEwEB/wQIMAYBAf8C AQAwSwYDVR0gBEQwQjBABgpghkgBhvhFAQcVMDIwMAYIKwYBBQUHAgEWJGh0dHBz Oi8vd3d3LnZlcmlzaWduLmNvbS9jcHMvdGVzdGNhLzA7BgNVHR8ENDAyMDCgLqAs hipodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9TVlJUcmlhbFJvb3RHMi5jcmwwDgYD VR0PAQH/BAQDAgEGMG0GCCsGAQUFBwEMBGEwX6FdoFswWTBXMFUWCWltYWdlL2dp ZjAhMB8wBwYFKw4DAhoEFI/l0xqGrI2Oa8PPgGrUSBgsexkuMCUWI2h0dHA6Ly9s b2dvLnZlcmlzaWduLmNvbS92c2xvZ28uZ2lmMB0GA1UdDgQWBBQoFxOKvdaitdwG LLe2jtoQZmBu5TAfBgNVHSMEGDAWgBRIGeeSb5KdNGOZwPCZyNaljIx/ZTANBgkq hkiG9w0BAQUFAAOCAQEANgvA9cj2h5yFC2SJMmE8a9trUmjnorZWO/Ifmdf5ADuQ uf+k8arodHpdSeq/f2GjwDIo3oYL2bT/66tw46Kx3Q/Z02pp7YW+BRvKejBYXN9F JxsXEkPKpz4SRvSQLl5YBst7q03nK0lZQ4/LE+hufgvx08JdqGd4o4cOvZ6o4MQa MgX/0lwNjC+4PWuKfmrKmr+RhpSkc72cEEO9//XsYesTMetY3nOuqXAQqiH4lz3K AzqNgohXXcF8W1F3ytTTq1yWbMkJonRpXbE3U0rWI33ywiS7LAk8n4dR8tNoqqIr P6sDtvolx9/+qTPWGnYytV0P/hcJt5CbqE7008EnPQAAMQAAAAAAAAA= -----END CERTIFICATE-----

  • Next, I copy the code to notepad and save as public.pem file
  • Then I use openssl command to check if it is in PEM format or not

openssl x509 -inform PEM -in public.pem

and i get error

unable to load certificate 1952:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:.\crypto\as n1\tasn_dec.c:1319: 1952:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:.\ crypto\asn1\tasn_dec.c:381:Type=X509_CINF 1952:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 e rror:.\crypto\asn1\tasn_dec.c:751:Field=cert_info, Type=X509 1952:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:.\crypto\pem\pem_oth .c:83:

--> this is not in PEM format, do I make a mistake here, please help ?

  • Follow this doc docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/…. Make sure the certificates and private key are in PEM format. If not, you will have to convert it. The link explains it all. – mezi Aug 20 '14 at 9:31
  • I still get issue with public certificate returns from the CA (verisign.com) - please see update above – Tam Minh Aug 21 '14 at 7:12
  • I'm voting to close this question as off-topic because the user has fixed the problem, as per a comment on an answer, but hasn't specified exactly what they did wrong and how they fixed it. Thus, the question will not be useful to anyone else. – Jenny D Aug 4 '17 at 20:21
0

That (update 1) file is in PEM format -- assuming the dashes-BEGIN-CERTIFICATE-dashes and dashes-END-CERTIFICATE-dashes are actually on separate lines, which isn't clear from your paste format -- but it is not a certificate in PEM format. PEM format is used for many different types of objects. This one is a PKCS7/CMS signed-data with empty data and two certs: one EE cert for Epinion dichcum.ga and one CA (chain) cert for Verisign Trial Secure Server CA G2. This format -- PKCS7 signed-data with empty data and certs -- is a common way to distribute related certs and is usually called "p7b" or "p7c".

Change the word CERTIFICATE in the BEGIN and END lines to PKCS7. Run openssl pkcs7 -print_certs <public.pem >tempfile. The output file tempfile will contain TWO text blocks each consisting of a BEGIN line, some lines of data, and an END line. Use any text editor or a utility like sed to put these blocks in separate files, let's say mycert.pem and chaincert.pem. Upload the first file as your cert and the second file as the chain cert, along with your private key file (apparently private.pem).

  • I'm sorry for the late response. Thanks Dave for your suggestion, I already buy the real one and setup successfully. Thanks. – Tam Minh Sep 9 '14 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.