5

Amazon has recently announced their new AWS Certificate Manager (ACM) service. This looks promising, but it is currently only supported in the us-east-1 region.

I have existing resources in the us-west-2 region. Is it possible for me to create a certificate using ACM, and then use it on an ELB instance in us-west-2? Or do I have to wait for Amazon to roll the service out to other regions? The documentation is frustratingly vague on this point.

(Possibly) Related questions:

Improve this question

3 Answers 3

Reset to default
12

Not as of now, no.

The answer to the question is slightly hidden, under an entirely different question in the ACM FAQ:

Q: Can I use the same certificate in more than one AWS Region?

It depends on whether you’re using Elastic Load Balancing or Amazon CloudFront. If you want to use a certificate with Elastic Load Balancing for the same site (the same fully qualified domain name, or FQDN, or set of FQDNs) in a different Region (when ACM is available in additional Regions), you will be required to request a new certificate for each Region in which you plan to use it. Certificates issued in the US East (Northern Virginia) Region and associated with an Amazon CloudFront distribution are distributed to the geographic locations configured for your distribution. (emphasis added)

https://aws.amazon.com/certificate-manager/faqs/

From that, we can safely conclude that the service can't be used for ELBs outside us-east-1, until such time as the service is deployed in the respective regions.

The AWS Global Infrastructure pages show the service only being available (as of this writing) in us-east-1.

The apparent discrepancy between in-region-only availability for ELB, compared with global availability with CloudFront, is explained by the fact that us-east-1 is the region that houses the infrastructure that actually controls the provisioning of all CloudFront edge locations.

Improve this answer
4
  • Finding this earlier would have saved me a lot of time. I read through the documentation, but the wording was ambiguous enough to make me think I might be mistake. The limitation is a real shame.
    – brice
    Apr 13, 2016 at 9:06
  • 1
    @brice I'm sure they will be launching it in other regions in a reasonable period of time. I've been using this in us-west-2 by using CloudFront, which -- because of the bandwidth pricing structure -- is essentially zero cost. The CF cache can be disabled. If you need SSL between CloudFront and the ELB or instance, you can use a wildcard cert you already have on hand, or get a cheap cert from, say, Gandi (no affiliation, but they give you a free 1 year cert for each domain you register), to use on the back-end connection. Or run HTTP between CF and EC2, but HTTPS to the browser.
    – Michael - sqlbot
    Apr 13, 2016 at 12:11
  • Thanks @Michael, Your suggestion worked great. I'm still testing to make sure that cloudfront isn't interfering with the requests, but it looks like that was a winner.
    – brice
    Apr 15, 2016 at 9:52
  • 1
    I had that concern initially, @brice but so far it's behaved perfectly -- be mindful of forwarding cookies, query strings, and headers appropriately and I wouldn't expect issues. When you get more comfortable with the idea, then try adding cache behaviors matching static file paths like *.css with cookies, query strings, and appropriate headers not forwarded, enable automatic content compression, and save bandwidth while improving page loads.
    – Michael - sqlbot
    Apr 15, 2016 at 13:21
2

This now works, I requested a certificate from Certificate Manager and assigned to my US West (Oregon) Elastic Load Balancer. I added an EC2 instance to the ELB and had the ELB point to port 80 on the EC2 instance, not port 443 (this is some what faster I suppose). The ELB will then encrypt the connection between the user and the EC2 instance.

Improve this answer
0

Is it possible for me to create a certificate using ACM, and then use it on an ELB instance in us-west-2?

Yes, as you can see here from official documentation, the ACM is now supported in other regions.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.