How to install an SSL/TLS certificate on Amazon Web Services (AWS)
The instructions below walk you through installing SSL on Amazon Web Services (AWS). If you have more than one server or device, you will need to install the certificate on each one you want to protect. If you have not generated your certificate or finished validation yet, see our CSR generation instructions before following the steps below.
Because Amazon Web Services covers a whole range of hosting products, we strongly suggest reading Amazon's own documentation to understand how your SSL is generated, uploaded and configured. AWS allows many different server setups, so there is no single answer that fits every customer.
That said, the steps below should get your SSL certificate installed in most cases.
What you will need
1. Your server certificate
This is the certificate the certificate authority issued for your domain. It may have been emailed to you. If not, you can download it from your account dashboard by clicking on your order.
2. Your intermediate certificates
These files let devices connecting to your server identify the issuing certificate authority. There may be more than one of them. If your certificate arrived in a ZIP folder, the intermediates — sometimes called the CA bundle — should be in there too. If not, download the right CA bundle for your certificate.
3. Your private key
This file should be on your server, or in your hands if you generated your CSR with a free generator tool. On some platforms, such as Microsoft IIS, the private key is not immediately visible to you but the server keeps track of it.
Installation instructions
1. Convert the server certificate to PEM format
Run the following to convert the server certificate to PEM:
openssl x509 -inform PEM -in my-certificate
2. Convert the intermediates to PEM format
Run the following to convert the certificate chain:
openssl x509 -inform PEM -in my-certificate-chain
3. Upload it to your AWS account
Run the following upload-server-certificate command against your AWS account:
aws iam upload-server-certificate \
--server-certificate-name my-server-cert \
--certificate-body file://my-server-certificate.pem \
--private-key file://my-private-key.pem \
--certificate-chain file://my-certificate-chain.pem
Note: if you hit an error, see the AWS documentation.
4. Configure an HTTPS listener
Amazon's documentation explains how to configure an HTTPS listener for your Classic Load Balancer.
That is it — your SSL certificate is installed. To check your work, open the site in your browser at https://yourdomain.tld and look at the certificate and site information to confirm HTTPS is working properly. Remember that you may need to restart your server before the changes take effect.
To check your installation properly, use our SSL Checker. If something does not add up, get in touch and we will look at it with you.
