Jan 01, 2014 Each AMI publisher on EC2 decides what user (or users) should have ssh access enabled by default and what ssh credentials should allow you to gain access as that user. For the second part, most AMIs allow you to ssh in to the system with the ssh keypair you specified at launch time. Create a new key pair and save the private key file. You can create a key pair using the console, AWS Command Line Interface (AWS CLI), or AWS Tools for Windows PowerShell. For more information, see Creating a Key Pair Using Amazon EC2. Note: To give the new key pair the same name as the lost key pair, you must first delete the lost key pair. Generate an SSH Key-pair. SSH is commonly used to connect to Amazon EC2 instances. To allow you to connect to your instances, you can generate a key-pair using the AWS CLI in your AWS Cloud9 instance. This example uses the key name mykey but you can change the name of your key. Enter the following command to generate a key pair.
Use the instructions on this page to use OpenSSL to create your certificate signing request (CSR) and then upload and implement your SSL certificate in your AWS instance.
To create your CSR, see OpenSSL: How to Create Your CSR.
To install your SSL certificate, see AWS: How to Install Your SSL Certificate.
If you are looking for a simpler way to create CSRs and install and manage your SSL certificates, we recommend using the DigiCert® Certificate Utility for Windows. You can use the DigiCert Utility to generate your CSR and install your SSL certificate. See Amazon Web Services: SSL Certificate CSR Creation.
Use the instructions below for using OpenSSL to create your own shell commands for generating your Amazon Web Service (AWS) CSR.
Recommended: Save yourself some time. Use the DigiCert OpenSSL CSR Wizard to generate an OpenSSL command for creating your AWS CSR. Just fill in the form details, click Generate, and paste your customized OpenSSL command into your terminal.
If you prefer, you can build your own shell commands for generating your AWS CSR.
Use your terminal client (ssh) to log into your server/workstation.
At the prompt, enter the following command:
Note: Make sure to replace server with the name of your server/workstation.
openssl req –new –newkey rsa:2048 –nodes –keyout server.key –out server.csr
You have now started the process for generating the following two files:
When prompted for the Common Name (domain name), type the fully qualified domain (FQDN) for the site that you are going to secure.
Note: If generating a AWS CSR for a DigiCert Wildcard SSL Certificate, the common name should begin with an asterisk (e.g., *.example.com).
When prompted, type your organizational information, beginning with your geographic information.
Note: You may have already set up default information.
Open the .csr file that you created with a text editor.
Copy the text, including the -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST----- tags, and paste it into the DigiCert order form.
Ready to order your SSL certificate.
Learn MoreBuy NowSave the (back up) the generated .key file. You need it later when installing your SSL certificate.
After receiving your SSL certificate form DigiCert, you can install it.
Copy the Certificate File to Your Server/Workstation
Download your Intermediate (DigiCertCA.crt) and Primary Certificate (your_domain_name.crt) files from your DigiCert account, then copy them to the directory on your server/workstation where you will keep your certificate and key files. Make them readable by root only.
Upload Your SSL Certificate
Next, you need to upload the certificate files (your_domain_com.key, your_domain_com.crt, and DigiCertCA.crt) to your AWS account.
Implement Your SSL Certificate
To implement your SSL certificate for your instance of AWS, consult the AWS Documentation.
Note: Because all instances of Amazon Web Service (AWS) are unique, it is best to consult the Amazon documentation for instructions on how to install and configure your SSL certificate for you AWS instance.
If your website is publicly accessible, our DigiCert® SSL Installation Diagnostic Tool can help you diagnose common problems.
I want to use the same SSH key pair to access my Amazon Elastic Compute Cloud (Amazon EC2) instances in all my AWS Regions. How do I do that?
To use a single SSH key pair for all your AWS Regions, first generate a public SSH key from a private SSH key. Then, import the key into each of your AWS Regions.
If you don't have one already, begin by creating an SSH key pair.
Linux
1. Generate a public SSH key (.pub) file from the private SSH key (.pem) file:
Note: Replace MyKeyPair.pem with the name of your private .pem file. Make sure that you are working on a bash shell and that the AWS CLI is configured with a user that has valid access.
2. Run the following command to set the AWS_REGIONS:
3. Run the following command to import the public SSH key into the Regions:
Windows
1. Generate a public SSH key (.pub) file from the private SSH key (.pem) file:
Open PuTTYgen.
Choose Load to load your private key file.
Choose Save public key.
2. Import the public SSH key into the desired AWS Regions by running the following commands:
Note: Replace MyKeyPair.pub with your public SSH file name.
Anything we could improve?
Need more help?