Managing SSL/TLS Certificates for Secure Applications
AWS Certificate Manager (ACM) is a service that lets you easily provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services and your internal connected resources.
Issued by a trusted public certificate authority (CA) and used for public-facing websites and applications.
Issued by AWS Private Certificate Authority (PCA) for internal resources and applications.
┌───────────────────┐ ┌───────────────────┐ ┌───────────────────┐ ┌───────────────────┐
│ │ │ │ │ │ │ │
│ Request │────▶│ Validate │────▶│ Issue │────▶│ Deploy │
│ Certificate │ │ Domain Ownership │ │ Certificate │ │ Certificate │
│ │ │ │ │ │ │ │
└───────────────────┘ └───────────────────┘ └───────────────────┘ └───────────────────┘
│
│
▼
┌───────────────────┐ ┌───────────────────┐ ┌───────────────────┐ ┌───────────────────┐
│ │ │ │ │ │ │ │
│ Revoke │◀────│ Monitor │◀────│ Renew │◀────│ Use │
│ (if needed) │ │ Certificate │ │ Certificate │ │ Certificate │
│ │ │ │ │ │ │ │
└───────────────────┘ └───────────────────┘ └───────────────────┘ └───────────────────┘
| Term | Definition |
|---|---|
| SSL/TLS | Secure Sockets Layer/Transport Layer Security - Protocols for establishing authenticated and encrypted links between networked computers |
| Certificate Authority (CA) | An entity that issues digital certificates that verify a digital entity's identity on the internet |
| Public Key Infrastructure (PKI) | A framework for managing digital certificates and public key encryption |
| Domain Validation (DV) | Verification that the certificate applicant controls the domain name in the certificate request |
| Server Name Indication (SNI) | An extension to TLS that allows a server to host multiple SSL certificates for different domains on the same IP address |
| Subject Alternative Name (SAN) | An extension to X.509 that allows multiple domain names to be protected by a single SSL certificate |
| Wildcard Certificate | A certificate that secures a domain and all its first-level subdomains (e.g., *.example.com) |
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are cryptographic protocols designed to provide secure communication over a computer network.
| SSL | TLS |
|---|---|
| Developed by Netscape | Developed by IETF |
| SSL 1.0, 2.0, 3.0 (all deprecated) | TLS 1.0, 1.1, 1.2, 1.3 |
| Less secure, vulnerable | More secure, actively maintained |
| No longer used in practice | Current standard (TLS 1.2/1.3) |
Note: "SSL" is still commonly used as a general term for both SSL and TLS protocols.
Client Server
│ │
│ Client Hello │
│─────────────────────────────────────────────────────▶
│ │
│ Server Hello │
│ Certificate │
│ Server Key Exchange │
│ Server Hello Done │
│◀─────────────────────────────────────────────────────
│ │
│ Client Key Exchange │
│ Change Cipher Spec │
│ Finished │
│─────────────────────────────────────────────────────▶
│ │
│ Change Cipher Spec │
│ Finished │
│◀─────────────────────────────────────────────────────
│ │
│ Application Data │
│◀────────────────────────────────────────────────────▶
│ │
A certificate chain is a sequence of certificates, where each certificate in the chain is signed by the entity identified by the next certificate in the chain.
┌───────────────────┐
│ │
│ Root CA │ (Self-signed)
│ Certificate │
│ │
└─────────┬─────────┘
│
│ signs
▼
┌───────────────────┐
│ │
│ Intermediate CA │
│ Certificate │
│ │
└─────────┬─────────┘
│
│ signs
▼
┌───────────────────┐
│ │
│ End-Entity │
│ Certificate │
│ │
└───────────────────┘
The chain establishes trust: if you trust the Root CA, you can trust the entire chain.
| Type | Validation | Use Cases | Issuance Time |
|---|---|---|---|
| Domain Validation (DV) | Verifies domain ownership only | Basic websites, blogs, personal sites | Minutes to hours |
| Organization Validation (OV) | Verifies domain ownership and organization | Business websites, e-commerce | 1-3 days |
| Extended Validation (EV) | Rigorous verification of legal entity | Banking, financial services, healthcare | 1-2 weeks |
ACM primarily issues DV certificates. For OV or EV certificates, you can import them into ACM.
Server Name Indication (SNI) is an extension to the TLS protocol that allows a client to specify the hostname it is attempting to connect to at the beginning of the handshake process.
Before SNI, a server could only present one SSL certificate per IP address, which meant:
SNI solved this by allowing the client to specify which hostname it wants to connect to before the server selects a certificate.
Client Server
│ │
│ ClientHello + SNI: "example.com" │
│─────────────────────────────────────────────────────▶
│ │
│ ┌─────────────┐│
│ │ Select cert ││
│ │ for ││
│ │ example.com ││
│ └─────────────┘│
│ │
│ ServerHello + Certificate for example.com │
│◀─────────────────────────────────────────────────────
│ │
│ Rest of TLS handshake │
│◀────────────────────────────────────────────────────▶
│ │
AWS services that support SNI include:
Most modern clients support SNI, but some older ones don't:
| Client | SNI Support |
|---|---|
| Chrome | Yes (all versions) |
| Firefox | Yes (v2.0+) |
| Safari | Yes (v3.0+) |
| Edge/IE | Yes (IE 7+ on Windows Vista+) |
| Android | Yes (v2.3+) |
| iOS | Yes (all versions) |
| Java | Yes (Java 7+) |
| IE on Windows XP | No |
For clients that don't support SNI, you can:
ALB supports multiple certificates through SNI:
# AWS CLI command to add certificates to ALB listener aws elbv2 add-listener-certificates \ --listener-arn arn:aws:elasticloadbalancing:region:account-id:listener/app/my-load-balancer/50dc6c495c0c9188/f2f7dc8efc522ab2 \ --certificates CertificateArn=arn:aws:acm:region:account-id:certificate/5cc54884-f4a3-4072-80be-05b9ba72f705
CloudFront supports SNI for custom domain names:
# CloudFront distribution configuration
{
"ViewerCertificate": {
"ACMCertificateArn": "arn:aws:acm:us-east-1:account-id:certificate/certificate-id",
"SSLSupportMethod": "sni-only",
"MinimumProtocolVersion": "TLSv1.2_2021"
}
}
HTTP listeners are components of load balancers that check for connection requests using the HTTP/HTTPS protocol and port you configure.
To create an HTTPS listener, you need:
Security policies define the SSL/TLS protocols and ciphers that the load balancer supports:
# AWS CLI command to create a rule aws elbv2 create-rule \ --listener-arn arn:aws:elasticloadbalancing:region:account-id:listener/app/my-load-balancer/50dc6c495c0c9188/f2f7dc8efc522ab2 \ --priority 10 \ --conditions Field=path-pattern,Values='/api/*' \ --actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:region:account-id:targetgroup/my-targets/73e2d6bc24d8a067
Routes requests to one or more target groups:
{
"Type": "forward",
"ForwardConfig": {
"TargetGroups": [
{
"TargetGroupArn": "arn:aws:elasticloadbalancing:region:account-id:targetgroup/blue-targets/73e2d6bc24d8a067",
"Weight": 80
},
{
"TargetGroupArn": "arn:aws:elasticloadbalancing:region:account-id:targetgroup/green-targets/73e2d6bc24d8a067",
"Weight": 20
}
]
}
}
Redirects HTTP requests to another URL:
{
"Type": "redirect",
"RedirectConfig": {
"Protocol": "HTTPS",
"Port": "443",
"Host": "#{host}",
"Path": "/#{path}",
"Query": "#{query}",
"StatusCode": "HTTP_301"
}
}
# AWS CLI command to create HTTP to HTTPS redirect
aws elbv2 create-listener \
--load-balancer-arn arn:aws:elasticloadbalancing:region:account-id:loadbalancer/app/my-load-balancer/50dc6c495c0c9188 \
--protocol HTTP \
--port 80 \
--default-actions Type=redirect,RedirectConfig="{Protocol=HTTPS,Port=443,Host='#{host}',Path='#{path}',Query='#{query}',StatusCode=HTTP_301}"
Client Application Load Balancer Target Group
│ │ │
│ HTTP Request (port 80) │ │
│────────────────────────────────────────────────────────────▶│ │
│ │ │
│ HTTP 301 Redirect to HTTPS │ │
│◀────────────────────────────────────────────────────────────│ │
│ │ │
│ HTTPS Request (port 443) │ │
│────────────────────────────────────────────────────────────▶│ │
│ │ Forward Request │
│ │─────────────────────────────────────────────────▶│
│ │ │
│ │ Response │
│ │◀─────────────────────────────────────────────────│
│ HTTPS Response │ │
│◀────────────────────────────────────────────────────────────│ │
│ │ │
ACM certificates can be used with the following AWS services: