Ssl – Can’t add SSL listener, Server Certificate not found for the key

amazon-web-servicesssl

I'm am trying to set up SSL on my load balancer with a certificate I purchased from GoDaddy.

When trying to upload the certificate in the console I got an error

Failed to create load balancer: Server Certificate not found for the key: arn:aws:iam::************:server-certificate/mycert

I've never encountered this error before when adding SSL certificates. I'm not sure why iam is even used here.

After some Googling, I was able to upload my certificate to iam using aws cli (again, not sure why I had to do this).

Now when modifying the listeners I can see my uploaded certificate as an existing SSL certificate. When I try to save the my changes to the load balancer however, I get the same error. I have verified that the certificate exists:

$ aws iam list-server-certificates
{
    "ServerCertificateMetadataList": [
        {
            "ServerCertificateId": "*********************", 
            "ServerCertificateName": "mycert", 
            "Expiration": "2018-11-19T18:47:38Z", 
            "Path": "/", 
            "Arn": "arn:aws:iam::************:server-certificate/mycert", 
            "UploadDate": "2015-11-19T19:23:32Z"
        }
    ]
}

(I have verified the obfuscated account number here is the same as in the error)

From here I am stuck. Why am I not able to apply my certificate to this load balancer?

Edit Thu Nov 19 11:47:18 PST 2015

After waiting for a while and logging out and in, I was able to update the listeners with my SSL certificate. However, it doesn't seem to be working correctly. When trying to load my domain over HTTPS the request times out. It seems it unable to load the certificate

$ echo | openssl s_client -connect www.example.com:443 2>/dev/null | openssl x509 -noout -subject
unable to load certificate
69457:error:0906D06C:PEM routines:PEM_read_bio:no start line:/SourceCache/OpenSSL098/OpenSSL098-52.30.1/src/crypto/pem/pem_lib.c:648:Expecting: TRUSTED CERTIFICATE

Best Answer

I faced the same problem when trying to create the ELB from the web console. I was trying to create a upload a new certificate there via GUI and it was finally failing with same error. I solved it by uploading the certificate files separately via aws cli. It is explained in this doc - http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/ssl-server-cert.html#upload-cert

Upload the certificate, private key and certificate chain like this

aws iam upload-server-certificate --server-certificate-name my-server-cert \
  --certificate-body file://my-certificate.pem --private-key file://my-private-key.pem \
  --certificate-chain file://my-certificate-chain.pem

And then go to the web console and choose the option "Choose an existing certificate from AWS Identity and Access Management (IAM)" and choose the certificate pair that was just uploaded. It will work fine after that.

Related Topic