12 ms·

AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS

350 points by _alex_ 11y ago

fragsworth 11y ago
It's about time.
- twothamendment 11y ago
  It is past time. Where was this last month? We just started using Let's Encrypt to get certs onto ELBs. With a few mods to stuff on github we can easily generate certs for multiple domains (up to the 100 domain limit) and put them on the ELB. I'm glad they are getting into this, competition is always good. With the pricing page giving a 404 I can only guess that it will cost more than Let's Encrypt, but if you haven't already rolled your own, it might be a nice option.
  - arcdigital 11y ago
    It's free :) http://aws.amazon.com/certificate-manager/pricing/ http://aws.amazon.com/certificate-manager/pricing/
    - twothamendment 11y ago
      It is, but using it would require us to use 5x as many ELBs as we need now (100 domains per cert vs 20). For some that isn't a problem and free is a great price. 20 domains on an ELB for a year, $10.80 per domain (ignoring traffic). Or put 5x as many on and get SSL for $2.16 per domain per year (also ignoring traffic). That said, I'm really happy to see AWS head this way. Even if someone uses them, in min mind Let's Encrypt did its job - drive the cost of SSL down to where everyone can have it.
  - marktangotango 11y ago
    Dumb question; I'm not an aws user, but I thought with ELBs you did ssl termination at the load balancer, then unencrypted to downstream servers? But you seem to indicate you have ssl between elb's and downstream? Is that correct?
    - twothamendment 11y ago
      Not a bad question. You are correct, the ELBs are doing ssl termination, but the way I'm using Let's Encrypt and a 3rd party python script means that each web server needs to be able to answer the challenge on port 80. For web server without a LB, that means you just run the script and it generates the file that needs served up on 80. With more than one web server you need to be able to server that file up on any instance that might get hit when the challenge request comes in. For some, DNS might be an easier way to prove domain ownership, but we have clients who control their DNS. Doing it all on the web means it is 100% in our hands.
mbesto 11y ago
Pricing page goes 404 :( http://aws.amazon.com/certificate-manager/pricing/ http://aws.amazon.com/certificate-manager/pricing/
- falcolas 11y ago
  Anything too much higher than "free" is probably going to be too high once Let's Encrypt implements DNS based validation. Of course, it does look like they support wildcard certs, so it probably won't be cheap. EDIT: Removed EV reference, these are DV only.
  - yuvipanda 11y ago
    Let's encrypt turned on DNS validation a few days ago https://twitter.com/letsencrypt/status/689919523164721152 https://twitter.com/letsencrypt/status/689919523164721152
    - falcolas 11y ago
      Hadn't seen that, thanks for the link!
  - pfg 11y ago
    DNS validation landed in production yesterday[1]! \o/ The official client doesn't support it yet though; you'll have to use alternative clients. [1]: https://twitter.com/letsencrypt/status/689919523164721152 https://twitter.com/letsencrypt/status/689919523164721152
    - sandGorgon 11y ago
      how does this work ? one of the big challenges with letsencrypt was that I'm unable to bake it in my Docker images. I had a circular dependency - where my nginx wont start without my certificate and letsencrypt needs nginx to be running to serve the temp file that it creates. does this solve that ? Am I now able to bake letsencrypt in my docker images ?
jsnk 11y ago
Given that Let's Encrypt is free, is there any reason why someone would use paid service for SSL certificates?
- dtnewman 11y ago
  If it integrates easily with AWS and the price is low, I would definitely take advantage of this.
  - dexterdog 11y ago
    The price is very low. It's as low as they can go.
- peterhadlaw 11y ago
  So Let's Encrypt - awesome. On a side note, I was wondering what the difference is between the base certs issued by LE vs. those fancy super, extra double / triple level certs ("EV"? if I recall) practically speaking.
  - givehimagun 11y ago
    LE enables Domain Validated certs...so you'll get a green lock in most browsers. The Extended Validation certs gives you the green lock AND the name of the organization. The EV assures you that the company you're doing business with has been vetted...but customers don't know and most have not been educated about the differences in encryption and trust.
  - cookiecaper 11y ago
    The gimmick on the super fancy certs that give the big green bar w/ company name next to the URL is that they supposedly mean the CA has done a super thorough investigation on the company and verified that they really are who they say they are. Those certs cost like $1k from most vendors. This could be valuable if you get a lot of people trying to imitate your company or domain; for example, something like nikeshoes.com v. nike.com. But since most customers don't actually know any difference, the practical value is very small. By contrast, a normal SSL cert is issued just by confirming control of one of the domain's email addresses.
baby 11y ago
You mean TLS certificates.
- hueving 11y ago
  Oh shit, how will people ever know what the article is referring to?
  - peterhadlaw 11y ago
    Your sobriety humbles me.
- regecks 11y ago
  If we're being pedantic, x.509.
  - baby 11y ago
    true that. But the problem here is that people keep writing SSL instead of TLS => People who have to setup https will implement SSL instead of TLS.
cagenut 11y ago
Its not immediately obvious clicking around, who's the CA?
- _alex_ 11y ago
  AWS is the CA: https://bugzilla.mozilla.org/show_bug.cgi?id=1172401 https://bugzilla.mozilla.org/show_bug.cgi?id=1172401 EDIT: Just got a cert from the new service. Here's a screenshot of the cert chain. Amazon is issuing them: https://imgur.com/VGos0eY https://imgur.com/VGos0eY
  - arcdigital 11y ago
    And just to further clarify - Amazon owns the Starfield root CA as well.
    - ehPReth 11y ago
      I may be wrong, but it looks like GoDaddy owns Starfield: https://certs.godaddy.com/repository/ https://certs.godaddy.com/repository/ (Mozilla inclusion request: https://bugzilla.mozilla.org/show_bug.cgi?id=527056 https://bugzilla.mozilla.org/show_bug.cgi?id=527056)
      - grahamedgecombe 11y ago
        Amazon bought one of the Starfield roots from GoDaddy last year: https://mobile.twitter.com/Cryptoki/status/611145411315666944 https://mobile.twitter.com/Cryptoki/status/61114541131566694...
        ehPReth 11y ago
        Ah, I missed that. Thanks!
- devy 11y ago
  tl;dr - For now, their root CA is Starfield[0], but AWS may become a root CA very soon. Amazon had applied to be a Root Certificate Authority to Mozilla and Android since June 2015 [1]. And it's been in pending for public discussion recently [2], which is one step away from being inclusion by Mozilla[3](aka becoming a root CA). Once they are vetted and being included in Mozilla's Root CA program, they will be accepted by Firefox browser and on Linux. And after vetted in Android, it will be accepted by Google Chrome/Chromium browsers.[4] [0] http://i.imgur.com/s2Uijes.png http://i.imgur.com/s2Uijes.png [1] http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-certificate-provider-applies-to-be-a-root-certifcate-authority/ http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-cer... [2] https://mozillacaprogram.secure.force.com/CA/PendingCACertificateReport https://mozillacaprogram.secure.force.com/CA/PendingCACertif... [3] https://wiki.mozilla.org/CA:How_to_apply#Public_discussion https://wiki.mozilla.org/CA:How_to_apply#Public_discussion [4] https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...
base 11y ago
Wrong title. This is a Certificate Manager.
- dang 11y ago
  We changed the title from "AWS is now issuing SSL certificates".
  - _alex_ 11y ago
    Why? AWS is issuing certificates. They happen to be doing that through their new Certificate Manager service, but the more interesting news is that AWS is issuing publicly trusted certs.
    - dang 11y ago
      It's a moot point now, because the announcement post (which we changed the URL to) has a different title. But the answer to your question is that we don't always have a magic title accuracy detector—though HN readers come close.
      - dsp1234 11y ago
        Thanks for updating it!
  - dsp1234 11y ago
    Better title would be "AWS is now issuing domain validated SSL certificates" since that's the actual news.
  - deleted 11y ago
    [deleted]
- _alex_ 11y ago
  The certs that Certificate Manager manages are issued by AWS
lukeadams 11y ago
Looks like Certificate Manager is only available in the US-East region thus far.
- draven 11y ago
  Yep, tried to access ACM, and got "Certificate Manager is not available in EU (Ireland). Please select another region." They probably are going to roll out this feature everywhere.
iancarroll 11y ago
It looks like this is free (the pricing page isn't up yet), as I was able to issue a certificate and not have any charges show immediately.
- mangeletti 11y ago
  You might be right. Maybe the pricing page 404 was a silly marketing stunt? That would be pretty clever. BTW, it looks like there might be a lot of people flagging this post (raced to position 1, but then quickly dropped to position 5). I'm not opposed to people flagging things or anything, but I'm curious as to why a post like this would be heavily flagged, if that is indeed what is happening.
- arcdigital 11y ago
  Yep, it's free :) http://aws.amazon.com/certificate-manager/pricing/ http://aws.amazon.com/certificate-manager/pricing/
michaelZejoop 11y ago
Buying SSL Cert through Bluehost (my domain registered, and blog hosted) and figuring out how to apply it my web-app, zejoop.com, hosted on AWS was far and away the most annoying and difficult chore in my development/deployment process as a relatively junior SW developer. If I could solve all inhouse within AWS (at reasonable cost) is be very happy. My cert just renewed, so until I roll change to AWS my https:// https:// is down. If update is as difficult for me as original install was, then I guess it will be about 18 hours of aggravation. So I'll look into this, if the OP title is a reality.
- tlianza 11y ago
  FYI (and disclaimer I work here) CloudFlare provides SSL as a service for free and you can host your site anywhere: https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/
  - michaelZejoop 11y ago
    Thanks, I will investigate. Not clear though if I'll need to convert the cert though to AWS load balancer accepted format... that was the bulk of my earlier problem, especially handling the chain bundle. The AWS cert service, I assume, would eliminate the conversion problem for me. Thanks... I'll check it out
    - michaelZejoop 11y ago
      problem solved
ademarre 11y ago
Are these certificates exclusively for ELB and CloudFront? Does anyone see a way to download a certificate for manual installation on a server (EC2 or otherwise)? https://docs.aws.amazon.com/acm/latest/userguide/setup-website.html https://docs.aws.amazon.com/acm/latest/userguide/setup-websi... > Currently, ACM Certificates are associated with Elastic Load Balancing load balancers or Amazon CloudFront distributions. Although you install your website on an Amazon EC2 instance, you do not deploy an ACM Certificate there. Instead, deploy the ACM Certificate on your Elastic Load Balancing load balancer or on your CloudFront distribution. Ideally ACM certificate issuance and deployment would be two separate things, and this would be a general-purpose CA, which just happens to have integrated deployment tools for ELB and CloudFront.
- breadtk 11y ago
  At the time of launch only ELB and CloudFront are supported.
- mivv 11y ago
  I was hoping the same but unfortunately you don't seem to be able to download a cert at this time.
nik736 11y ago
"Even better, you can do all of this at no extra cost. SSL/TLS certificates provisioned through AWS Certificate Manager are free!" Great!
dang 11y ago
Url changed from https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html https://docs.aws.amazon.com/acm/latest/userguide/acm-overvie..., which seems to be the main announcement.
arcdigital 11y ago
Just in case people haven't figured it out yet - ACM issues free wildcard certs :)! http://aws.amazon.com/certificate-manager/pricing/ http://aws.amazon.com/certificate-manager/pricing/ https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html https://docs.aws.amazon.com/acm/latest/userguide/acm-certifi...
- Someone1234 11y ago
  Dumb question: Can you extract the private certificate and use it elsewhere, or is it held securely and only accessible via specific AWS services?
  - arcdigital 11y ago
    Yeah, currently the keys are held securely within AWS and it's only available for use within specific AWS services - Elastic Load Balancer & CloudFront at the moment.
    - alanh 11y ago
      So, no.
      - deleted 11y ago
        [deleted]
      - HorizonXP 11y ago
        I mean, since they're offering for free what many others charge ~$100 USD for, I'm not surprised. That said, SSL certs and domain renewals are the least interesting but high importance items of running an online business. As I'm already heavily deployed on AWS, I have no problem having them handle all of this for me, for what is free to me. (yes yes, not technically free)
        deleted 11y ago
        [deleted]
philip1209 11y ago
This is great for microservices where managing lots of SSL certs can be a pain.
ubergeek42 11y ago
Can anyone think of any advantages LetsEncrypt would provide over this offering from AWS? Or does this basically kill LetsEncrypt's usage on AWS? The only thing I can think of is that AWS Certificate Manager only validates by email addresses which can be problematic if you don't have MX records or don't have control over it(Maybe a large organization where the people who do control those email addresses won't click simple verification links) It seems a bit inconsistent as to when it will use the email on the whois record for the validation too. For some subdomains I try it will allow validation using the whois address, other times it's just the common aliases@sub.domain.com(which requires an mx record) So I guess if you're nesting deeper than one subdomain(e.g. abc.def.example.com) then maybe it'd be easier to get letsencrypt set up than try to get mx records for abc.def.example.com. Shameless Plug/Disclaimer: I had been working on a tool to make it dead simple to use Lets-Encrypt certificates for CloudFront/ELBs and handled autorenewal via Lambda. I'm not sure there is any use for this now that this exists though. https://github.com/ubergeek42/lambda-letsencrypt/ https://github.com/ubergeek42/lambda-letsencrypt/
- tal_berzniz 11y ago
  LetsEncrypt is automated, so for hosting services who wants to issue certs for customers - LetsEncrypt currently wins
- kevincox 11y ago
  I believe this requires the use of cloudfront or their load balancer. So if you want to stick with minimal costs you can use letsencrypt with just an ec2 instance.
  - ubergeek42 11y ago
    That's a good point. For some reason the only thing I was thinking about was cloudfront/elb.
- koolba 11y ago
  I don't think you have access to the actual private key file so this would be restricted to AWS services like an ELB. With letsencrypt you have the key file as well so you can use it for securing any type of connection (not just a load balancer front end).
ttcbj 11y ago
Just a few days ago I spent $200 to purchase a multi-domain wildcard certificate so that I could host multiple secure domains, with multiple subdomains, on a single elastic beanstalk app. It was such a headache to figure out that I needed the multi-domain wildcard cert, then to find one to purchase for a reasonable price. Now, 5 days later, AWS lets me create one for free in 3 minutes, with zero hassles. I cannot select it in beanstalk yet, but I am sure that will come. I am consistently amazed by how frequently AWS satisfies needs I barely knew (or didn't know) I had.
- dexterdog 11y ago
  I don't think you configure the LB in EB. Go into Load Balancers in your EC2 section and you can select the cert there. It's a quick switch.
  - 15155 11y ago
    If EB decides to tear down and rebuild an ELB, it won't have the correct cert settings.
- mentat 11y ago
  You can probably manually specify in EB config files for ELB. Haven't touched that in a couple years but support should be able to help. If not reach out and I'll try to reconstruct.
- arcdigital 11y ago
  I just made this post about enabling beanstalk: https://medium.com/@arcdigital/enabling-ssl-via-aws-certificate-manager-on-elastic-beanstalk-b953571ef4f8 https://medium.com/@arcdigital/enabling-ssl-via-aws-certific...
- derFunk 11y ago
  I'm feeling the same. Just send a bunch of personal data to an Israeli CA. With having ACM earlier that would have been obsolete.
- Human_USB 11y ago
kujjwal 11y ago
Currently It's Only supported in US East (N. Virginia). Is there any way I can use it for apps deployed in different geographical location?
dankohn1 11y ago
This is fantastic news. Now, let's see Heroku use either this or Let's Encrypt and eliminate their onerous $20 per host SSL fee, which is making the Internet less secure.
- colinbartlett 11y ago
  This would be huge. Heroku's high monthly SSL cost is a big reason I've moved dozens of smaller apps and sites to Digital Ocean. As I moved to using SSL everywhere I realized Heroku's costs were not sustainable for random side projects and static sites.
nodesocket 11y ago
This is great, but I'm willing to pay for SSL certificates that are managed inside of AWS, just like domains are purchased and managed in Route53. As long as AWS provides an API to provision certificates, that would be awesome. I use Nginx, and need access to the private key and cert.
- brandur 11y ago
  Impressively, not only is there what looks like a fairly complete API, but it's shipped and part of their language bindings already. Go interface (the docs haven't been updated as of yet): https://github.com/aws/aws-sdk-go/blob/87b1e60a50b09e4812dee560b33a238f67305804/service/acm/acmiface/interface.go https://github.com/aws/aws-sdk-go/blob/87b1e60a50b09e4812dee... And the changelog from the Ruby project: https://github.com/aws/aws-sdk-ruby/blob/8ed439546619f78263fd6755429d54cdce812133/CHANGELOG.md#2213-2016-01-21 https://github.com/aws/aws-sdk-ruby/blob/8ed439546619f78263f...
  - tjbiddle 11y ago
    While awesome that they have API support already; that's only half of it as you don't get access to the private key. Still incredibly exciting and a great feature for Amazon solutions!
arcdigital 11y ago
If you're trying to enable ACM on beanstalk, I made a guide on how to do it: https://medium.com/@arcdigital/enabling-ssl-via-aws-certificate-manager-on-elastic-beanstalk-b953571ef4f8 https://medium.com/@arcdigital/enabling-ssl-via-aws-certific...
- michaelZejoop 11y ago
  Thanks for documenting that! Now if I could only remember where I put my I put my 'AWS Access Key ID' and its corresponding 'AWS Secret Access Key' so that I could 'aws configure' from the CLI I'd be golden! The guide looks great though.
  - michaelZejoop 11y ago
    I have since fixed my problem by creating a new key/key-ID pair.
- michaelZejoop 11y ago
  Guide is great, except my environment (which can't be renamed) is "My First Elastic BeanStalk Application" - this results in error on CLI "Value 'My First Elastic BeanStalk Application' at 'environmentName' failed to satisfy constraint: Member must have length less than or equal to 23"... stuck
  - michaelZejoop 11y ago
    I figured out my own mistakes: [1] the actual name was 'Default-Environment', and [2] I had used the wrong zone when I set up AWS CLI using the 'aws configure' command. Fixed both mistakes and zejoop dot com is back online with a working SSL Cert.
- Human_USB 11y ago
  This may help too: option_settings: aws:elb:listener:80: ListenerEnabled: false aws:elb:listener:443: InstancePort: "80" InstanceProtocol: "HTTP" ListenerProtocol: "HTTPS" SSLCertificateID: "<replace with ACM cert ARN>"
ajsharp 11y ago
Sucks to be in the cert market today. This is great news for everyone else though!
ajeet_dhaliwal 11y ago
Wow, this is awesome for my needs.
supersan 11y ago
Wow that was super easy. I tried this on one of my sites and it really took me like 2 minutes total to add SSL to it. The only confusing part was that port 443 was blocked in ELB by default (which made it look like it didn't work but got fixed easily as soon as I figured it out). I've never seen an easier way to do this till date.
jwaldrip 11y ago
Implemented and deployed! Now just need Terraform support to bring it full circle.
osoti 11y ago
Undertaker had kept the name “Cain the Undertaker” during his career, read this and more on WWE: http://goo.gl/8tJOig http://goo.gl/8tJOig
derFunk 11y ago
How will Amazon's new root certificate be spread to all browsers and mobile devices, so it's made sure that it will be trusted on every possible endpoint? Is the root certificate cross signed with another, already trusted cert?
- dchest 11y ago
  Amazon bought one of the Starfield roots from GoDaddy. See their roots here: https://www.amazontrust.com/repository/ https://www.amazontrust.com/repository/
  - derFunk 11y ago
    Thanks, but funny: Not all test URLs are working on my Marshmallow Android. Only the "valid" tagged "Amazon Root CA 1" is accepted by my mobile Chrome, not so the others. Also the revoked Starfield test url is still being accepted by my browser.
JosephHatfield 11y ago
If you use the AWS Simple Monthly Calculator, it shows a $600 a month charge for one dedicated IP/SSL certificate on Cloudfront. Is this not the same thing as the new free certificate?

350 points by _alex_ 11y ago

fragsworth 11y ago

It's about time.

twothamendment 11y ago
It is past time. Where was this last month? We just started using Let's Encrypt to get certs onto ELBs. With a few mods to stuff on github we can easily generate certs for multiple domains (up to the 100 domain limit) and put them on the ELB. I'm glad they are getting into this, competition is always good. With the pricing page giving a 404 I can only guess that it will cost more than Let's Encrypt, but if you haven't already rolled your own, it might be a nice option.
- arcdigital 11y ago
  It's free :) http://aws.amazon.com/certificate-manager/pricing/ http://aws.amazon.com/certificate-manager/pricing/
  - twothamendment 11y ago
    It is, but using it would require us to use 5x as many ELBs as we need now (100 domains per cert vs 20). For some that isn't a problem and free is a great price. 20 domains on an ELB for a year, $10.80 per domain (ignoring traffic). Or put 5x as many on and get SSL for $2.16 per domain per year (also ignoring traffic). That said, I'm really happy to see AWS head this way. Even if someone uses them, in min mind Let's Encrypt did its job - drive the cost of SSL down to where everyone can have it.
- marktangotango 11y ago
  Dumb question; I'm not an aws user, but I thought with ELBs you did ssl termination at the load balancer, then unencrypted to downstream servers? But you seem to indicate you have ssl between elb's and downstream? Is that correct?
  - twothamendment 11y ago
    Not a bad question. You are correct, the ELBs are doing ssl termination, but the way I'm using Let's Encrypt and a 3rd party python script means that each web server needs to be able to answer the challenge on port 80. For web server without a LB, that means you just run the script and it generates the file that needs served up on 80. With more than one web server you need to be able to server that file up on any instance that might get hit when the challenge request comes in. For some, DNS might be an easier way to prove domain ownership, but we have clients who control their DNS. Doing it all on the web means it is 100% in our hands.

mbesto 11y ago

Pricing page goes 404 :( http://aws.amazon.com/certificate-manager/pricing/ http://aws.amazon.com/certificate-manager/pricing/

falcolas 11y ago
Anything too much higher than "free" is probably going to be too high once Let's Encrypt implements DNS based validation. Of course, it does look like they support wildcard certs, so it probably won't be cheap. EDIT: Removed EV reference, these are DV only.
- yuvipanda 11y ago
  Let's encrypt turned on DNS validation a few days ago https://twitter.com/letsencrypt/status/689919523164721152 https://twitter.com/letsencrypt/status/689919523164721152
  - falcolas 11y ago
    Hadn't seen that, thanks for the link!
- pfg 11y ago
  DNS validation landed in production yesterday[1]! \o/ The official client doesn't support it yet though; you'll have to use alternative clients. [1]: https://twitter.com/letsencrypt/status/689919523164721152 https://twitter.com/letsencrypt/status/689919523164721152
  - sandGorgon 11y ago
    how does this work ? one of the big challenges with letsencrypt was that I'm unable to bake it in my Docker images. I had a circular dependency - where my nginx wont start without my certificate and letsencrypt needs nginx to be running to serve the temp file that it creates. does this solve that ? Am I now able to bake letsencrypt in my docker images ?

jsnk 11y ago

Given that Let's Encrypt is free, is there any reason why someone would use paid service for SSL certificates?

dtnewman 11y ago
If it integrates easily with AWS and the price is low, I would definitely take advantage of this.
- dexterdog 11y ago
  The price is very low. It's as low as they can go.
peterhadlaw 11y ago
So Let's Encrypt - awesome. On a side note, I was wondering what the difference is between the base certs issued by LE vs. those fancy super, extra double / triple level certs ("EV"? if I recall) practically speaking.
- givehimagun 11y ago
  LE enables Domain Validated certs...so you'll get a green lock in most browsers. The Extended Validation certs gives you the green lock AND the name of the organization. The EV assures you that the company you're doing business with has been vetted...but customers don't know and most have not been educated about the differences in encryption and trust.
- cookiecaper 11y ago
  The gimmick on the super fancy certs that give the big green bar w/ company name next to the URL is that they supposedly mean the CA has done a super thorough investigation on the company and verified that they really are who they say they are. Those certs cost like $1k from most vendors. This could be valuable if you get a lot of people trying to imitate your company or domain; for example, something like nikeshoes.com v. nike.com. But since most customers don't actually know any difference, the practical value is very small. By contrast, a normal SSL cert is issued just by confirming control of one of the domain's email addresses.

baby 11y ago

You mean TLS certificates.

hueving 11y ago
Oh shit, how will people ever know what the article is referring to?
- peterhadlaw 11y ago
  Your sobriety humbles me.
regecks 11y ago
If we're being pedantic, x.509.
- baby 11y ago
  true that. But the problem here is that people keep writing SSL instead of TLS => People who have to setup https will implement SSL instead of TLS.

cagenut 11y ago

Its not immediately obvious clicking around, who's the CA?

_alex_ 11y ago
AWS is the CA: https://bugzilla.mozilla.org/show_bug.cgi?id=1172401 https://bugzilla.mozilla.org/show_bug.cgi?id=1172401 EDIT: Just got a cert from the new service. Here's a screenshot of the cert chain. Amazon is issuing them: https://imgur.com/VGos0eY https://imgur.com/VGos0eY
- arcdigital 11y ago
  And just to further clarify - Amazon owns the Starfield root CA as well.
  - ehPReth 11y ago
    I may be wrong, but it looks like GoDaddy owns Starfield: https://certs.godaddy.com/repository/ https://certs.godaddy.com/repository/ (Mozilla inclusion request: https://bugzilla.mozilla.org/show_bug.cgi?id=527056 https://bugzilla.mozilla.org/show_bug.cgi?id=527056)
    - grahamedgecombe 11y ago
      Amazon bought one of the Starfield roots from GoDaddy last year: https://mobile.twitter.com/Cryptoki/status/611145411315666944 https://mobile.twitter.com/Cryptoki/status/61114541131566694...
      - ehPReth 11y ago
        Ah, I missed that. Thanks!
devy 11y ago
tl;dr - For now, their root CA is Starfield[0], but AWS may become a root CA very soon. Amazon had applied to be a Root Certificate Authority to Mozilla and Android since June 2015 [1]. And it's been in pending for public discussion recently [2], which is one step away from being inclusion by Mozilla[3](aka becoming a root CA). Once they are vetted and being included in Mozilla's Root CA program, they will be accepted by Firefox browser and on Linux. And after vetted in Android, it will be accepted by Google Chrome/Chromium browsers.[4] [0] http://i.imgur.com/s2Uijes.png http://i.imgur.com/s2Uijes.png [1] http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-certificate-provider-applies-to-be-a-root-certifcate-authority/ http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-cer... [2] https://mozillacaprogram.secure.force.com/CA/PendingCACertificateReport https://mozillacaprogram.secure.force.com/CA/PendingCACertif... [3] https://wiki.mozilla.org/CA:How_to_apply#Public_discussion https://wiki.mozilla.org/CA:How_to_apply#Public_discussion [4] https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...

base 11y ago

Wrong title. This is a Certificate Manager.

dang 11y ago
We changed the title from "AWS is now issuing SSL certificates".
- _alex_ 11y ago
  Why? AWS is issuing certificates. They happen to be doing that through their new Certificate Manager service, but the more interesting news is that AWS is issuing publicly trusted certs.
  - dang 11y ago
    It's a moot point now, because the announcement post (which we changed the URL to) has a different title. But the answer to your question is that we don't always have a magic title accuracy detector—though HN readers come close.
    - dsp1234 11y ago
      Thanks for updating it!
- dsp1234 11y ago
  Better title would be "AWS is now issuing domain validated SSL certificates" since that's the actual news.
- deleted 11y ago
  [deleted]
_alex_ 11y ago
The certs that Certificate Manager manages are issued by AWS

lukeadams 11y ago

Looks like Certificate Manager is only available in the US-East region thus far.

draven 11y ago
Yep, tried to access ACM, and got "Certificate Manager is not available in EU (Ireland). Please select another region." They probably are going to roll out this feature everywhere.

iancarroll 11y ago

It looks like this is free (the pricing page isn't up yet), as I was able to issue a certificate and not have any charges show immediately.

mangeletti 11y ago
You might be right. Maybe the pricing page 404 was a silly marketing stunt? That would be pretty clever. BTW, it looks like there might be a lot of people flagging this post (raced to position 1, but then quickly dropped to position 5). I'm not opposed to people flagging things or anything, but I'm curious as to why a post like this would be heavily flagged, if that is indeed what is happening.
arcdigital 11y ago
Yep, it's free :) http://aws.amazon.com/certificate-manager/pricing/ http://aws.amazon.com/certificate-manager/pricing/

michaelZejoop 11y ago

Buying SSL Cert through Bluehost (my domain registered, and blog hosted) and figuring out how to apply it my web-app, zejoop.com, hosted on AWS was far and away the most annoying and difficult chore in my development/deployment process as a relatively junior SW developer. If I could solve all inhouse within AWS (at reasonable cost) is be very happy. My cert just renewed, so until I roll change to AWS my https:// https:// is down. If update is as difficult for me as original install was, then I guess it will be about 18 hours of aggravation. So I'll look into this, if the OP title is a reality.

tlianza 11y ago
FYI (and disclaimer I work here) CloudFlare provides SSL as a service for free and you can host your site anywhere: https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/
- michaelZejoop 11y ago
  Thanks, I will investigate. Not clear though if I'll need to convert the cert though to AWS load balancer accepted format... that was the bulk of my earlier problem, especially handling the chain bundle. The AWS cert service, I assume, would eliminate the conversion problem for me. Thanks... I'll check it out
  - michaelZejoop 11y ago
    problem solved

ademarre 11y ago

Are these certificates exclusively for ELB and CloudFront? Does anyone see a way to download a certificate for manual installation on a server (EC2 or otherwise)? https://docs.aws.amazon.com/acm/latest/userguide/setup-website.html https://docs.aws.amazon.com/acm/latest/userguide/setup-websi... > Currently, ACM Certificates are associated with Elastic Load Balancing load balancers or Amazon CloudFront distributions. Although you install your website on an Amazon EC2 instance, you do not deploy an ACM Certificate there. Instead, deploy the ACM Certificate on your Elastic Load Balancing load balancer or on your CloudFront distribution. Ideally ACM certificate issuance and deployment would be two separate things, and this would be a general-purpose CA, which just happens to have integrated deployment tools for ELB and CloudFront.

breadtk 11y ago
At the time of launch only ELB and CloudFront are supported.
mivv 11y ago
I was hoping the same but unfortunately you don't seem to be able to download a cert at this time.

nik736 11y ago

"Even better, you can do all of this at no extra cost. SSL/TLS certificates provisioned through AWS Certificate Manager are free!" Great!

dang 11y ago

Url changed from https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html https://docs.aws.amazon.com/acm/latest/userguide/acm-overvie..., which seems to be the main announcement.

arcdigital 11y ago

Just in case people haven't figured it out yet - ACM issues free wildcard certs :)! http://aws.amazon.com/certificate-manager/pricing/ http://aws.amazon.com/certificate-manager/pricing/ https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html https://docs.aws.amazon.com/acm/latest/userguide/acm-certifi...

Someone1234 11y ago
Dumb question: Can you extract the private certificate and use it elsewhere, or is it held securely and only accessible via specific AWS services?
- arcdigital 11y ago
  Yeah, currently the keys are held securely within AWS and it's only available for use within specific AWS services - Elastic Load Balancer & CloudFront at the moment.
  - alanh 11y ago
    So, no.
    - deleted 11y ago
      [deleted]
    - HorizonXP 11y ago
      I mean, since they're offering for free what many others charge ~$100 USD for, I'm not surprised. That said, SSL certs and domain renewals are the least interesting but high importance items of running an online business. As I'm already heavily deployed on AWS, I have no problem having them handle all of this for me, for what is free to me. (yes yes, not technically free)
      - deleted 11y ago
        [deleted]

philip1209 11y ago

This is great for microservices where managing lots of SSL certs can be a pain.

ubergeek42 11y ago

Can anyone think of any advantages LetsEncrypt would provide over this offering from AWS? Or does this basically kill LetsEncrypt's usage on AWS? The only thing I can think of is that AWS Certificate Manager only validates by email addresses which can be problematic if you don't have MX records or don't have control over it(Maybe a large organization where the people who do control those email addresses won't click simple verification links) It seems a bit inconsistent as to when it will use the email on the whois record for the validation too. For some subdomains I try it will allow validation using the whois address, other times it's just the common aliases@sub.domain.com(which requires an mx record) So I guess if you're nesting deeper than one subdomain(e.g. abc.def.example.com) then maybe it'd be easier to get letsencrypt set up than try to get mx records for abc.def.example.com. Shameless Plug/Disclaimer: I had been working on a tool to make it dead simple to use Lets-Encrypt certificates for CloudFront/ELBs and handled autorenewal via Lambda. I'm not sure there is any use for this now that this exists though. https://github.com/ubergeek42/lambda-letsencrypt/ https://github.com/ubergeek42/lambda-letsencrypt/

tal_berzniz 11y ago
LetsEncrypt is automated, so for hosting services who wants to issue certs for customers - LetsEncrypt currently wins
kevincox 11y ago
I believe this requires the use of cloudfront or their load balancer. So if you want to stick with minimal costs you can use letsencrypt with just an ec2 instance.
- ubergeek42 11y ago
  That's a good point. For some reason the only thing I was thinking about was cloudfront/elb.
koolba 11y ago
I don't think you have access to the actual private key file so this would be restricted to AWS services like an ELB. With letsencrypt you have the key file as well so you can use it for securing any type of connection (not just a load balancer front end).

ttcbj 11y ago

Just a few days ago I spent $200 to purchase a multi-domain wildcard certificate so that I could host multiple secure domains, with multiple subdomains, on a single elastic beanstalk app. It was such a headache to figure out that I needed the multi-domain wildcard cert, then to find one to purchase for a reasonable price. Now, 5 days later, AWS lets me create one for free in 3 minutes, with zero hassles. I cannot select it in beanstalk yet, but I am sure that will come. I am consistently amazed by how frequently AWS satisfies needs I barely knew (or didn't know) I had.

dexterdog 11y ago
I don't think you configure the LB in EB. Go into Load Balancers in your EC2 section and you can select the cert there. It's a quick switch.
- 15155 11y ago
  If EB decides to tear down and rebuild an ELB, it won't have the correct cert settings.
mentat 11y ago
You can probably manually specify in EB config files for ELB. Haven't touched that in a couple years but support should be able to help. If not reach out and I'll try to reconstruct.
arcdigital 11y ago
I just made this post about enabling beanstalk: https://medium.com/@arcdigital/enabling-ssl-via-aws-certificate-manager-on-elastic-beanstalk-b953571ef4f8 https://medium.com/@arcdigital/enabling-ssl-via-aws-certific...
derFunk 11y ago
I'm feeling the same. Just send a bunch of personal data to an Israeli CA. With having ACM earlier that would have been obsolete.
Human_USB 11y ago

kujjwal 11y ago

Currently It's Only supported in US East (N. Virginia). Is there any way I can use it for apps deployed in different geographical location?

dankohn1 11y ago

This is fantastic news. Now, let's see Heroku use either this or Let's Encrypt and eliminate their onerous $20 per host SSL fee, which is making the Internet less secure.

colinbartlett 11y ago
This would be huge. Heroku's high monthly SSL cost is a big reason I've moved dozens of smaller apps and sites to Digital Ocean. As I moved to using SSL everywhere I realized Heroku's costs were not sustainable for random side projects and static sites.

nodesocket 11y ago

This is great, but I'm willing to pay for SSL certificates that are managed inside of AWS, just like domains are purchased and managed in Route53. As long as AWS provides an API to provision certificates, that would be awesome. I use Nginx, and need access to the private key and cert.

brandur 11y ago
Impressively, not only is there what looks like a fairly complete API, but it's shipped and part of their language bindings already. Go interface (the docs haven't been updated as of yet): https://github.com/aws/aws-sdk-go/blob/87b1e60a50b09e4812dee560b33a238f67305804/service/acm/acmiface/interface.go https://github.com/aws/aws-sdk-go/blob/87b1e60a50b09e4812dee... And the changelog from the Ruby project: https://github.com/aws/aws-sdk-ruby/blob/8ed439546619f78263fd6755429d54cdce812133/CHANGELOG.md#2213-2016-01-21 https://github.com/aws/aws-sdk-ruby/blob/8ed439546619f78263f...
- tjbiddle 11y ago
  While awesome that they have API support already; that's only half of it as you don't get access to the private key. Still incredibly exciting and a great feature for Amazon solutions!

arcdigital 11y ago

If you're trying to enable ACM on beanstalk, I made a guide on how to do it: https://medium.com/@arcdigital/enabling-ssl-via-aws-certificate-manager-on-elastic-beanstalk-b953571ef4f8 https://medium.com/@arcdigital/enabling-ssl-via-aws-certific...

michaelZejoop 11y ago
Thanks for documenting that! Now if I could only remember where I put my I put my 'AWS Access Key ID' and its corresponding 'AWS Secret Access Key' so that I could 'aws configure' from the CLI I'd be golden! The guide looks great though.
- michaelZejoop 11y ago
  I have since fixed my problem by creating a new key/key-ID pair.
michaelZejoop 11y ago
Guide is great, except my environment (which can't be renamed) is "My First Elastic BeanStalk Application" - this results in error on CLI "Value 'My First Elastic BeanStalk Application' at 'environmentName' failed to satisfy constraint: Member must have length less than or equal to 23"... stuck
- michaelZejoop 11y ago
  I figured out my own mistakes: [1] the actual name was 'Default-Environment', and [2] I had used the wrong zone when I set up AWS CLI using the 'aws configure' command. Fixed both mistakes and zejoop dot com is back online with a working SSL Cert.
Human_USB 11y ago
This may help too: option_settings: aws:elb:listener:80: ListenerEnabled: false aws:elb:listener:443: InstancePort: "80" InstanceProtocol: "HTTP" ListenerProtocol: "HTTPS" SSLCertificateID: "<replace with ACM cert ARN>"

ajsharp 11y ago

Sucks to be in the cert market today. This is great news for everyone else though!

ajeet_dhaliwal 11y ago

Wow, this is awesome for my needs.

supersan 11y ago

Wow that was super easy. I tried this on one of my sites and it really took me like 2 minutes total to add SSL to it. The only confusing part was that port 443 was blocked in ELB by default (which made it look like it didn't work but got fixed easily as soon as I figured it out). I've never seen an easier way to do this till date.

jwaldrip 11y ago

Implemented and deployed! Now just need Terraform support to bring it full circle.

osoti 11y ago

Undertaker had kept the name “Cain the Undertaker” during his career, read this and more on WWE: http://goo.gl/8tJOig http://goo.gl/8tJOig

derFunk 11y ago

How will Amazon's new root certificate be spread to all browsers and mobile devices, so it's made sure that it will be trusted on every possible endpoint? Is the root certificate cross signed with another, already trusted cert?

dchest 11y ago
Amazon bought one of the Starfield roots from GoDaddy. See their roots here: https://www.amazontrust.com/repository/ https://www.amazontrust.com/repository/
- derFunk 11y ago
  Thanks, but funny: Not all test URLs are working on my Marshmallow Android. Only the "valid" tagged "Amazon Root CA 1" is accepted by my mobile Chrome, not so the others. Also the revoked Starfield test url is still being accepted by my browser.

JosephHatfield 11y ago

If you use the AWS Simple Monthly Calculator, it shows a $600 a month charge for one dedicated IP/SSL certificate on Cloudfront. Is this not the same thing as the new free certificate?