I have a network load balancer which has my mqtt instance as target.I have hosted mqtt server on my instance and I have a python script which sends traffic to my mqtt instance via network load balancer. It currently works on TCP. Now I want to make the connection secure between network load balancer and my client so I have added a listener which listens on port 8883 and I have attached acm certificates on it. Now my issue is how do I get client certificate which I will add to my python script? Any help would be appreciated.
Asked
Active
Viewed 2,034 times
2 Answers
1
If you generate a certificate via the public ACM CA you are not able to export the certificate, you will only be able to associate it with managed AWS resources such as elastic load balancers, CloudFront, VPNs and API Gateway.
If you want to be able to control the physical certificate your choices are limited to the below:
- AWS ACM Private CA, this is an extended part of the ACM service but can be expensive.
- A free SSL signing service such as certbot, these will need to be rotated more frequently than your standard CA.
- Purchase an SSL through a trusted certificate authority
Chris Williams
- 32,215
- 4
- 30
- 68
0
Now my issue is how do I get client certificate which I will add to my python script?
You can't export your certificate out of ACM. If you require to have control of a private key from your SSL cert, you need to get it from a third party, not from ACM.
ACM certs can only be used on load balancer, API gateway and CloudFront distro. If you want to use SSL cert somewhere else, you must get it from a third party. A popular choice is https://letsencrypt.org/.
Marcin
- 215,873
- 14
- 235
- 294
-
But if I have attached a certificate on NLB and now I want to create tls connection with my script how do i do it? I would need a client certificate on my client? – Akshay Jindal Oct 30 '20 at 10:38
-
@AkshayJindal You can use self-signed certificate on your instances. ACM can't be used on instances. – Marcin Oct 30 '20 at 10:43