AWS Certificate Association

Question

I missed the email advising me to renew my AWS certificate and am trying to disassociate it from my domain so I can delete it and get a new one. I installed and configured the Amazon CLI, but I cannot find documentation to disassociate the certificate.

I'm new to this and could use some help, specifically syntax to disassociate the certificate.

Thanks,

where is the certificate configured? a load balancer? – Arun Kamalanathan Jul 25 '20 at 15:44 — Arun Kamalanathan, Jul 25 '20 at 15:44

score 2 · Answer 1 · answered Jul 25 '20 at 15:52

I finally figured it out. I am using AWS CloudFront and simply changed the certificate from the AWS issued certificate to the default CloudFront certificate. I was then able to delete the certificate.

The certificate in question was not eligible for renewal.

score 1 · Answer 2 · answered Jul 25 '20 at 15:45

You never need to disassociate the certificate, you would instead create your new certificate and then replace its usage with whichever service you're using.

For either a NLB or an ALB you would use the modify-listener command, specifying the arn of the SSL.
For the classic load balancer you would use the set-load-balancer-listener-ssl-certificate
For a CloudFront distribution you would use the update-distribution
For an API Gateway you would use update-domain-name

For CloudFront ensure your SSL is in us-east-1, otherwise create in the region of the resource you're attaching to.

It might also be worth for the future using the free ACM certificate as this will auto-renew.

AWS Certificate Association

2 Answers2