Unable to install certificate

[dlapiduz]

Unable to install certificate

[jareware]

The certs themselves are fine, as I'm able to just grab them after the failure and successfully upload them with $ aws iam upload-server-certificate from the shell.

[jareware]

I also tried patching this call to also set:

cf_cfg['DistributionConfig']['ViewerCertificate']['CertificateSource'] = 'iam'

but no cigar; that took me back to the original error I was getting.

[jareware]

From the logs, this is what we GET for the distribution config:

    <ViewerCertificate>
        <CertificateSource>cloudfront</CertificateSource>
        <MinimumProtocolVersion>SSLv3</MinimumProtocolVersion>
        <CloudFrontDefaultCertificate>true</CloudFrontDefaultCertificate>
    </ViewerCertificate>

And this is what we POST back:

    <ViewerCertificate>
        <MinimumProtocolVersion>SSLv3</MinimumProtocolVersion>
        <IAMCertificateId>REDACTED</IAMCertificateId>
        <CertificateSource>iam</CertificateSource>
    </ViewerCertificate>

The value for <IAMCertificateId> is definitely the same as in the response to uploading the cert (from the <ServerCertificateId> field). So from the error "Your IAMCertificateId does not match the given Certificate field", I really have no idea what "Certificate field" refers to; even http://docs.aws.amazon.com/AmazonCloudFront/latest/APIReference/PutConfig.html only lists the <ViewerCertificate> stuff above.

Any pointers appreciated.

[dillona]

I am experiencing this as well

[dillona]

I was able to use the web console to set the certificate and everything worked

[dillona]

I was able to get it working after appending the following:
cf_cfg['DistributionConfig']['ViewerCertificate']['Certificate'] = cert_id
cf_cfg['DistributionConfig']['ViewerCertificate']['CertificateSource'] = 'iam'
cf_cfg['DistributionConfig']['ViewerCertificate']['SSLSupportMethod'] = 'sni-only'
cf_cfg['DistributionConfig']['ViewerCertificate']['MinimumProtocolVersion'] = 'TLSv1'

[jareware]

Well done! Looking forward to this landing in a release. :)

[ryansb]

That should be fixed (partially) with this commit but I'm not sure if it's in a release.

[ryansb]

Also, @dillona, the line cf_cfg['DistributionConfig']['ViewerCertificate']['SSLSupportMethod'] = 'sni-only' should be configurable since some CF distributions may be paying for the dedicated IP to support non-SNI clients.

[dillona]

@ryansb In my PR #13 I only set sni-only as a default if nothing else is already set.
So if you are already paying for the dedicated IPs, nothing will be changed

[ryansb]

@dillona Oh, that does handle it. Thanks for pointing that out.

[dlapiduz]

That PR was merged so you should be all good to go now. Thanks everyone!