Certificate and key format for importing
ACM requires you to separately import the certificate, certificate chain, and
private key (if any), and to encode each component in PEM format. PEM stands for Privacy
Enhanced Mail. The PEM format is often used to represent certificates, certificate
requests, certificate chains, and keys. The typical extension for a PEMâformatted
file is .pem, but it doesn't need to be.
Note
AWS does not provide utilities for manipulating PEM files or other certificate
formats. The following examples rely on a generic text editor for simple operations.
If you need to perform more complex tasks (such as converting file formats or
extracting keys), free and open-source tools such as OpenSSL
The following examples illustrate the format of the files to be imported. If the components come to you in a single file, use a text editor (carefully) to separate them into three files. Note that if you edit any of the characters in a PEM file incorrectly or if you add one or more spaces to the end of any line, the certificate, certificate chain, or private key will be invalid.
Example 1. PEMâencoded certificate
-----BEGINÂ CERTIFICATE-----
Base64âencoded certificate
-----ENDÂ CERTIFICATE-----Example 2. PEMâencoded certificate chain
A certificate chain contains one or more certificates. You can use a text editor,
the copy command in Windows, or the Linux cat command to
concatenate your certificate files into a chain. The certificates must be
concatenated in order so that each directly certifies the one preceding. If
importing a private certificate, copy the root certificate last. The following
example contains three certificates, but your certificate chain might contain more
or fewer.
Important
Do not copy your certificate into the certificate chain.
-----BEGINÂ CERTIFICATE-----
Base64âencoded certificate
-----ENDÂ CERTIFICATE-----
-----BEGINÂ CERTIFICATE-----
Base64âencoded certificate
-----ENDÂ CERTIFICATE-----
-----BEGINÂ CERTIFICATE-----
Base64âencoded certificate
-----ENDÂ CERTIFICATE-----Example 3. PEMâencoded private keys
X.509 version 3 certificates use public key algorithms. When you create an X.509 certificate or certificate request, you specify the algorithm and the key bit size that must be used to create the privateâpublic key pair. The public key is placed in the certificate or request. You must keep the associated private key secret. Specify the private key when you import the certificate. The key must be unencrypted. The following example shows an RSA private key.
-----BEGINÂ PRIVATEÂ KEY-----
Base64âencoded private key
-----ENDÂ PRIVATEÂ KEY-----The next example shows a PEMâencoded elliptic curve private key. Depending on how you create the key, the parameters block might not be included. If the parameters block is included, ACM removes it before using the key during the import process.
-----BEGIN EC PARAMETERS-----
Base64âencoded parameters
-----END EC PARAMETERS-----
-----BEGIN EC PRIVATE KEY-----
Base64âencoded private key
-----END EC PRIVATE KEY-----
