How can we have a CSR signed using AWS ACM?

To have a CSR signed using AWS ACM, you'll need to use AWS Certificate Manager Private Certificate Authority (ACM PCA). The standard AWS ACM service is designed for public certificates and doesn't support signing external CSRs directly. However, ACM PCA allows you to create your own private certificate authority and sign CSRs.

Here's the command you'll need to use:

aws acm-pca issue-certificate --certificate-authority-arn "arn:aws:acm-pca:us-east-..." --csr file://csr_in_pem_format.csr --signing-algorithm SHA384WITHECDSA --template-arn arn:aws:acm-pca:::template/EndEntityCertificate/V1 --validity Value=9,Type="YEARS" --idempotency-token 1234

ADDRESSING THE CSR MISMATCH ERROR The CSR mismatch error you're seeing in Salesforce typically occurs when:

• The certificate you're uploading doesn't correspond to the CSR that was generated
• The private key used to generate the CSR doesn't match the certificate
• There's a format issue with the certificate or CSR