How do I import a third-party issued TLS/SSL certificate to ACM?

Resolution

Prerequisites:

• Make sure that you provide the certificate, its private key, and the certificate chain to ACM.
• Your certificate must also include the prerequisites to import ACM certificates.

To import in PEM-encoded format, you must have a PEM-encoded certificate, certificate chain, and private key. For more information, see Certificate and key format for importing.

(Optional) Use OpenSSL to convert the certificate bundle from PFX to PEM

If your certificate is in PKCS#12 (PFX) format, then convert the certificate bundle from PFX to PEM format. Then, import the PEM-encoded certificate to ACM.

Complete the following steps:

1. To copy the PFX or P12 file to the same location as your OpenSSL tool, or specify the location in the command line, run the following OpenSSL command:

   openssl pkcs12 -in PKCS12file -out Cert_Chain_Key.txt

   Note: Replace PKCS12file with your certificate file name.
2. Enter the required password and passphrase. The certificate, private key, and certificate chain are parsed and placed into the Cert_Chain_Key.txt file.
   Note: The private key is encrypted in the Base64-encoded private key format.

Decrypt the private key

Complete the following steps:

1. To copy the private key from the Cert_Chain_Key.txt file into your OpenSSL directory, or specify the location in the command line, run the following OpenSSL command:

   openssl rsa -in Encrypted.key -out UnEncrypted.key

   Note: Replace Encrypted.key with your encrypted private key file name.
2. Enter the passphrase. The UnEncrypted.key is now the decrypted private key. To verify the decrypted private key works, use a text editor to open the UnEncrypted.key file and view the headers.

Related information

Why can't I import a third-party public SSL/TLS certificate into ACM?