2

Can you import an existing certificate using ACM to be used by your LoadBalancerListener via CloudFormation?

On ACM FAQ, it does not tell it can be done on cloudformation concerning the importing of SSL.

Q: Can I import a third party certificate and use it with AWS services?

Yes. If you want to use a third-party certificate with Amazon CloudFront or Elastic Load Balancing, you may import it into ACM using the AWS Management Console, AWS CLI, or AWS Certificate Manager APIs. ACM does not manage the renewal process for imported certificates. You can use the AWS Management Console to monitor the expiration dates of an imported certificates and import a new third-party certificate to replace an expiring one.

As for the cloudformation documentation concerning the ACM. It doesn't provide properties to import an existing certificate to be used on my stack based on the below properties

Type: "AWS::CertificateManager::Certificate"
Properties: 
    DomainName: String
    DomainValidationOptions:
      - DomainValidationOptions
    SubjectAlternativeNames:
      - String
    Tags:
      - Resource Tag
  • 1
    in case someone has this issue. We just uploaded our certificate to AWS and use the arn they provide. For cases like we want to change certificate or renew another one - we then update arn if needed. – groobie newbie Aug 17 '17 at 5:29
2

You can import the cert into ACM at first, and then provide Certificate ARN as the Parameters of ELB in the CF template.

following an example of CF:

Parameters:
        "CerttificationArn": {
            "Default": "",
            "Description": "ARN for the Certificate",
            "Type": "String"
        },

ELB:

....
                "Listeners": [
                    {
                        "LoadBalancerPort": "80",
                        "InstancePort": "80",
                        "Protocol": "HTTP"
                    },
                    {
                        "LoadBalancerPort": "443",
                        "Protocol": "HTTPS",
                        "InstancePort": "443",
                        "InstanceProtocol": "HTTPS",
                        "PolicyNames": [ "SSL-Policy" ],
                        "SSLCertificateId": { "Ref": "CerttificationArn" }
                    }
...
0

Short answer: No this documentation as an overview to available CloudFormation ressources.

Also note that, while you can import certificates in the ACM console, they actually seem to be associated with IAM, and do not appear in the ACM console (at least for me).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.