How do I import a third-party issued SSL/TLS certificate to ACM?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Prerequisites:

• Your certificate must meet the prerequisites to import ACM certificates.
• To import in PEM-encoded format, you must have a PEM-encoded certificate, certificate chain, and private key. For more information, see Certificate and key format for importing.

Import certificate bundles in the PFX format

To import certificate bundles in the PKCS#12 (PFX) format, complete the following tasks.

Use OpenSSL to convert the certificate bundle to PEM format

If your certificate is in PFX format, then convert the certificate bundle to the PEM format. Then, import the PEM-encoded certificate to ACM.

Complete the following steps:

1. To copy the file to the same location as your OpenSSL tool, or specify the location in the command line, run the following OpenSSL command:

   openssl pkcs12 -in PKCS12file -out Cert_Chain_Key.txt

   Note: Replace PKCS12file with your certificate file name.
2. Enter the required password and passphrase. OpenSSL parses the certificate, private key, and certificate chain and places these parts into the Cert_Chain_Key.txt file.
   Note: The private key is encrypted in the Base64-encoded private key format.

Decrypt the private key

Complete the following steps:

1. To copy the private key from the Cert_Chain_Key.txt file into your OpenSSL directory, or specify the location in the command line, run the following OpenSSL command:

   openssl rsa -in Encrypted.key -out UnEncrypted.key

   Note: Replace Encrypted.key with your encrypted private key file name.
2. Enter the passphrase. The UnEncrypted.key is now the decrypted private key.
3. To verify the decrypted private key works, use a text editor to open the UnEncrypted.key file and view the headers.

Import certificate bundles in the DER format

To import certificate bundles in the DER format, complete the following tasks.

Use OpenSSL to convert the certificate bundle from DER to PEM

If your certificate is in DER format, then convert the certificate bundle to the PEM format. Then, import the PEM-encoded certificate to ACM.

Complete the following steps:

1. To copy the DER file to the same location as your OpenSSL tool, or specify the location in the command line, run the following OpenSSL command:

   openssl x509 -inform DER -in Certificate.der -outform PEM -out Certificate.pem

   Note: Replace Certificate.der with your certificate file name.
2. To copy the certificate chain from DER to PEM, run the following OpenSSL command:

   openssl x509 -inform DER -in Certificate_chain.der -outform PEM -out Certificate_chain.pem

   Note: Replace Certificate_chain.der with your certificate chain file name.

OpenSSL converts the certificate and certificate chain and places the parts into the Certificate.pem file and Certificate_chain.pem in PEM format.

Decrypt the private key

Complete the following steps:

1. To convert the private key from the PrivateKey.der file into your OpenSSL directory, or specify the location in the command line, run the following OpenSSL command:

   openssl rsa -inform DER -in PrivateKey.der -outform PEM -out PrivateKey.pem

   Note: Replace PrivateKey.der with your encrypted private key file name.
2. Enter the passphrase. The PrivateKey.pem is now the decrypted private key.
3. To verify the decrypted private key works, use a text editor to open the PrivateKey.pem file and view the headers.

Import the certificate into ACM

Before you import the certificate into ACM, make sure the certificate meets the following configurations:

• The certificate is in PEM format.
• The certificate chain is in PEM format.
• The private key is unencrypted and in PEM format.

Then, use the ACM console or the AWS CLI to import the certificate.

Related information

Why can't I import a third-party public SSL/TLS certificate into ACM?