CODEWITHSUNDEEP
amazon-web-servicessslcertificatessl-certificateamazon-iam
Aegix
Aegix

Reputation: 649

Renewing IAM SSL Server Certificates

I have been using IAM server certificates for some of my Elastic Beanstalk applications, but now its time to renew -- what is the correct process for replacing the current certificate with the updated cert?

When I try repeating an upload using the same command as before:

aws iam upload-server-certificate --server-certificate-name foo.bar --certificate-body file://foobar.crt --private-key file://foobar.key --certificate-chain file://chain_bundle.crt

I receive:

A client error (EntityAlreadyExists) occurred when calling the UploadServerCertificate operation: The Server Certificate with name foo.bar already exists.

Is the best practice to simply upload using a DIFFERENT name then switch the load balancers to the new certificate? This makes perfect sense - but I wanted to verify I'm following the correct approach.

EDIT 2015-03-30

I did successfully update my certificate using the technique above. That is - I uploaded the new cert using the same technique as originally, but with a different name, then updated my applications to point to the new certificate.

The question remains however, is this the correct approach?

Upvotes: 3

Views: 1319

Answers (1)

Michael - sqlbot
Michael - sqlbot

Reputation: 179462

Yes, that is the correct approach.

Otherwise, you would be forced to roll it out to every system that used it at the same time, with no opportunity to test, first, if desired.

My local practice, which is I don't intend to imply is The One True Way™, yet serves the purpose nicely, is to append -yyyy-mm for the year and month of the certificate's expiration date to the end of the name, making it easy to differentiate between them at a glance... and using this pattern, when the list sorted is lexically, they're coincidentally sorted chronologically as well.

Upvotes: 4

Related Questions