Create public Certificate which already exists in another account

Question

Hello,

We recently notice that our public certificate was created in a wrong account of the organization. Because we can't export and import the certificate from an account to another one, I wanted to know if it's possible to create a new public certificate with the same domain in another account of the organization ?
For the validation we use our public Route53 hosted zone so we will be allow to create the CNAME record to validate the request. If it's possible we will do that before removing the previous certificate.

The second question is about the under certificates created from this one. I imagine they won't work because the wildcard certificate has changed so they will need to ask a new certificate ?

Thank you for your help !

Riku_Kobayashi · Accepted Answer

Hello.

You can create a public certificate for the same domain from ACM in a different account.  
As described in the following document, ACM validation CNAME records are issued with unique values ​​for each account, so certificates can be issued for each account.  
https://aws.amazon.com/certificate-manager/faqs/?nc1=h_ls#dns-validation  
> How does ACM construct CNAME records?  
> DNS CNAME records have two components: a name and a label. The name component of an ACM-generated CNAME is constructed from an underscore character (_) followed by a token, which is a unique string that is tied to your AWS account and your domain name. ACM pre-pends the underscore and token to your domain name to construct the name component. ACM constructs the label from an underscore character pre-pended to a different token which is also tied to your AWS account and your domain name. ACM pre-pends the underscore and token to a DNS domain name used by AWS for validations: acm-validations.aws. The following examples show the formatting of CNAMEs for www.example.com, subdomain.example.com, and *.example.com.

> The second question is about the under certificates created from this one. I imagine they won't work because the wildcard certificate has changed so they will need to ask a new certificate ?

What do you mean by "under certificates"?  
I don't think you can issue "under certificates" from a certificate issued by ACM.  
If you want to replace it with a new certificate, you will need to re-request each one.

Ludovic Blondiau · Answer

Hello Riku_Kobayashi,

Thank you for the informations, I got confused with domain, sub domain and certificates.
I understand that every thing that use the certificate in Account X will need to update their configuration to use the new certificate for the same domain in Account Y.

Regards,

Create public Certificate which already exists in another account

Add your answer

Relevant content