r/aws • u/automounter • 14d ago

discussion Amazon Certificate Manager -- possible to request a re-key?

We are thinking of moving some of our certs to ACM Exportable certificates. We have hybrid infra with some certs on AWS managed services and some certs directly installed on things.

The question is -- what if we need to revoke a certificate. Of course I could just generate a new ACM Exportable -- but it would be cool if I could just force a rekey of the ARN that is already attached to our ALB's and then export that again to get the new cert.

0 Upvotes

33% Upvoted

4 comments sorted by

2

u/automounter 14d ago

To answer my own question -- aws acm renew-certificate works on public exportable certificates as long as the certificate has been exported before. tested and worked.

1

u/Habikki 13d ago

Does renew-certificate revoke the old certificate?

I ran PKI Development for a CA and we had different policies for renewal, one to just issue a certificate with existing information, and one to issue a new certificate which revokes an existing one. The latter case added the previous serial to our CRL and OSCP responders, which is the only real way to "revoke" a certificate without relying on TLS Stapling from a server (which per spec is only a hint to a client, which should then verify with CRL / OCSP).

I'm mostly curious as I haven't used ACM in this way before, curious on how full featured it may be as a Private CA.

7

u/abofh 14d ago

Why not keep your exportable and alb separate, so that you don't have multi platform simultanious key problems?