- Newest
- Most votes
- Most comments
Hello,
Currently, there isn't a single unified solution to automatically discover all certificates across AWS services. However, you can use different methods to compile a comprehensive list of certificates:
- For IAM Server Certificates:
- Use AWS CLI command: aws iam list-server-certificates
- Service-Specific Certificate Discovery:
- Elastic Load Balancers: Review load balancer configurations
- CloudFront Distributions: Check distribution settings for custom SSL certificates
- API Gateway: Examine custom domain configurations
- EC2 Instances: Manual inspection required for directly installed certificates
- For Imported Third-Party Certificates in ACM:
- Use AWS CLI command: aws acm list-certificates
- Regarding certificates manually embedded in application code or Kubernetes manifests (like in EKS), the discovery process is can be done through the following methods,
- Utilize Kubernetes native tools for EKS environments
- Implement container scanning tools for image-embedded certificates
- Deploy monitoring scripts for runtime discovery
- Consider migrating to managed solutions like ACM or cert-manager for improved visibility
Please note that you'll need to combine multiple approaches based on your specific environment and applications, as there's no single tool that can discover all manually imported certificates across all possible locations.
References: [+] https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-list.html [+] https://docs.aws.amazon.com/acm/latest/userguide/acm-services.html [+] https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https.certificate.html [+] https://docs.aws.amazon.com/eks/latest/userguide/cert-signing.html
To discover certificates used in AWS services, including those not from AWS Certificate Manager (ACM), you have a few options:
- Using the ACM console:
- Open the ACM console at https://console.aws.amazon.com/acm/
- The console will display all certificates managed by ACM, including those that were imported from external sources
- Imported certificates will have the type "Imported" in the listing
- Using the AWS CLI:
- Run the
aws acm list-certificatescommand to list all certificates in your account - This will return the ARNs and domain names of your certificates
- To specifically find imported certificates (those not issued by ACM), you can use:
aws acm list-certificates --query 'CertificateSummaryList[?Type==IMPORTED].CertificateArn' - After identifying the ARNs, you can use the
describe-certificatecommand to get more details about each certificate
The ACM console can display up to 500 certificates per page, while the CLI can display up to 1000. The listing includes information such as domain name, type, status, and whether the certificate is in use.
Note that ACM only shows certificates that are either issued by ACM or have been imported into ACM. If you have certificates deployed directly to services without going through ACM, you would need to check each service individually for those certificates.
Sources
Options for AWS customers who use Entrust-issued certificates | AWS Security Blog
List certificates managed by AWS Certificate Manager - AWS Certificate Manager
Use ListCertificates with an AWS SDK or CLI - AWS SDK Code Examples
ListCertificates - AWS Certificate Manager
Relevant content
asked a year ago
asked 4 years ago
asked 3 years ago
Certificates are manually imported into AWS services. For example, in EKS, users specify certificates at the code level. Can we discover these kinds of certificates?