[SOLVED] Uploading SSL Certificate to IAM for Cloudfront

Uploading SSL Certificate to IAM for Cloudfront

There's tons of Cloudfront questions out there, however the Googling for possible problems still amazes me. Here's mine...

What I'm currently attempting right now is to upload an SSL cert to IAM so I can use a custom domain name for Cloudfront (e.g. https://assets.mydomain.com). This, however, isn't going so well. The certs were purchased from DNSimple. The AWS cli upload is as so:

aws iam upload-server-certificate \
  --server-certificate-name MyDomainProduction \
  --path /cloudfront/ \
  --certificate-body file://~/Downloads/STAR_mydomain_com/STAR_mydomain_com.crt \
  --private-key file://~/Downloads/STAR_mydomain_com.key \
  --certificate-chain file://~/Downloads/STAR_mydomain_com.pem

The error:

A client error (MalformedCertificate) occurred when calling the
UploadServerCertificate operation: Unable to validate certificate
chain. The certificate chain must start with the immediate signing
certificate, followed by any intermediaries in order. The index within
the chain of the invalid certificate is: 1

I think I've tried 500 different possibilities and I'm out of ideas as to why I can't get things to work. Here's what I got in my toolbox for what DNSimple and Comodo handed back to me:

STAR_mydomain_com.pem
STAR_mydomain_com.key
STAR_mydomain_com/AddTrustExternalCARoot.crt
STAR_mydomain_com/COMODORSADomainValidationSecureServerCA.crt
STAR_mydomain_com/COMODORSAAddTrustCA.crt
STAR_mydomain_com/STAR_mydomain_com.crt

What's the right combination of crts, pem, and key to get SSL working on Cloudfront?

Solution

You're almost done. The error is that you are using the wrong intermediate certificate file. You should use the bundle that only includes the chain, without the primary certificate.

In other words, from the DNSimple installation wizard, select Other and download the files (1), (2) and (4). You downloaded (3) instead of (4).

The main difference is that (3) is (4) + (1). But as you are already passing (1) explicitly using the --certificate-body param, Cloudfront only wants the chain without the primary.