43

I am using aws certificate manager for managing SSL. Recently I purchased a wildcard ssl *.example-private.com Now I need that SSL certificate to deploy on enterprise git instance on aws.

How can i download ssl from aws?

| improve this question | |
  • 6
    Side note: If you really purchased a certificate, it wasn't from Amazon. Theirs are free. – ceejayoz Dec 21 '16 at 13:12
  • @ceejayoz I mean I requested wild card ssl certificate in aws certificate manager and I deployed it on ELB that i have in account. – Shailesh Sutar Dec 21 '16 at 13:56
  • @ceejayoz lets say I've git instance with url git.example-private.com and I want to deploy ssl over it. what should I do in that case? and forget about the wildcard ssl i.e. *.example-private.com – Shailesh Sutar Dec 21 '16 at 14:07
  • 3
    Put an ELB or CloudFront in front of the instance. Otherwise, you'll need to get an SSL from someone else (Let's Encrypt is free and highly recommended). ACM certificates can't be downloaded for use outside of AWS's built-in integrations like ELBs and CF. – ceejayoz Dec 21 '16 at 14:58
  • 1
    @ceejayoz Thanks for the suggestion. It worked with few tweaks according to my production environment. – Shailesh Sutar Dec 21 '16 at 17:14
56

You cannot download a SSL certificate from ACM.

| improve this answer | |
  • 12
    Specifically, from the ACM FAQ: You can use ACM with the following AWS services: Elastic Load Balancing, Amazon CloudFront, Amazon API Gateway, AWS Elastic Beanstalk. I was hoping to use a ACM cert on an EC2 instance... but that's not possible at this time. – geerlingguy Jul 26 '17 at 18:56
  • You now can. serverfault.com/a/878274/325277 – rangeme Jun 6 at 23:12
  • 3
    @rangeme No, you can't. See my comment on that answer. (To clarify: You can get the cert, but so can anyone who visits your site. The cert is public. What OP needs is the private key, which you still can't download.) – ceejayoz Jun 7 at 2:53
  • @ceejayoz Ah yes, my apologies. – rangeme Jun 8 at 23:52
16

Note: While this can be used to fetch the (already public) certificate, it does not download the private key necessary to use that certificate outside Amazon's systems.

It is now possible to download the certificate with the following command:

aws acm list-certificates / aws acm get-certificate

Ref:http://docs.aws.amazon.com/cli/latest/reference/acm/get-certificate.html

| improve this answer | |
  • Where does this document states that one can download certificate? I didn't see any such option in that document. Could you please share the exact link? – Shailesh Sutar Oct 13 '17 at 16:24
  • SO you are right Shailesh, i mistakenly pasted the wrong URL... url updated. – Muhammad Shoaib Irtaza Oct 14 '17 at 17:46
  • 19
    This gets you the certificate, but you can get that with cURL or just by going to the website - it is 100% public information. It does not get the private key, which means this is useless for OP's purposes. – ceejayoz Oct 16 '17 at 13:34
  • 3
    @ceejayoz is right. When I want to download SSL that means I want to download its private key so that I can deploy aws acm ssl to any server I want. I think that it's not possible to do it in anyway. – Shailesh Sutar Oct 24 '17 at 18:17
9

You cannot download from ACM. from the FAQ:

Q: Can I use certificates on Amazon EC2 instances or on my own servers?

A: No. At this time, certificates provided by ACM can only be used with specific AWS services

| improve this answer | |
  • 9
    Why are you re-answering an old question with the same answer that's been already provided to and accepted by the OP? – ceejayoz Aug 28 '17 at 13:03
  • 3
    this answer provided more info and context so i'm upvoting it – FireDragon Mar 20 '18 at 2:15
5

You can't, but you can get a free one from https://letsencrypt.org/certificates/.

Letsencrypt also offers an API backed by open source code to automatically update.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.