How to Implement AWS Certificate Manager for SSL/TLS

# Certificate covers:
example.com           # Apex domain
www.example.com       # WWW subdomain
api.example.com       # API subdomain
app.example.com       # Application subdomain
admin.example.com     # Admin subdomain
*.example.com         # Any other subdomain

# Request certificate with wildcard support
aws acm request-certificate \
    --domain-name example.com \
    --subject-alternative-names "*.example.com" \
    --validation-method DNS \
    --tags Key=Environment,Value=Production Key=Project,Value=Website \
    --region us-east-1

# Response includes CertificateArn for use in subsequent steps

# CNAME records to add to your DNS provider
# Record 1 (apex domain)
Type:  CNAME
Name:  _abc123def456.example.com
Value: _xyz789.acm-validations.aws.

# Record 2 (wildcard)
Type:  CNAME
Name:  _abc123def456.example.com
Value: _xyz789.acm-validations.aws.

# Note: Both domains often use the same validation record

# Verify DNS record is resolving
dig _abc123def456.example.com CNAME

# Alternative: Use nslookup
nslookup -type=CNAME _abc123def456.example.com

# Check certificate status via CLI
aws acm describe-certificate \
    --certificate-arn arn:aws:acm:us-east-1:ACCOUNT:certificate/CERT-ID \
    --query 'Certificate.Status' \
    --region us-east-1

# Expected output when validated: "ISSUED"

# Create SNS topic for certificate alerts
aws sns create-topic \
    --name acm-certificate-alerts \
    --region us-east-1

# Subscribe email to the topic
aws sns subscribe \
    --topic-arn arn:aws:sns:us-east-1:ACCOUNT:acm-certificate-alerts \
    --protocol email \
    --notification-endpoint security@yourcompany.com \
    --region us-east-1

# Create CloudWatch alarm for certificate expiration
aws cloudwatch put-metric-alarm \
    --alarm-name "ACM-Certificate-Expiring-Soon" \
    --alarm-description "Alert when ACM certificate expires within 30 days" \
    --metric-name DaysToExpiry \
    --namespace AWS/CertificateManager \
    --statistic Minimum \
    --period 86400 \
    --threshold 30 \
    --comparison-operator LessThanThreshold \
    --dimensions Name=CertificateArn,Value=arn:aws:acm:us-east-1:ACCOUNT:certificate/CERT-ID \
    --evaluation-periods 1 \
    --alarm-actions arn:aws:sns:us-east-1:ACCOUNT:acm-certificate-alerts \
    --region us-east-1

# Create AWS Config rule to check certificate expiration
aws configservice put-config-rule \
    --config-rule '{
        "ConfigRuleName": "acm-certificate-expiration-check",
        "Description": "Checks if ACM certificates expire within specified days",
        "Source": {
            "Owner": "AWS",
            "SourceIdentifier": "ACM_CERTIFICATE_EXPIRATION_CHECK"
        },
        "InputParameters": "{\"daysToExpiration\": \"30\"}",
        "MaximumExecutionFrequency": "TwentyFour_Hours"
    }' \
    --region us-east-1

# This rule marks certificates as NON_COMPLIANT when expiring within 30 days

# Create EventBridge rule for ACM Health events
aws events put-rule \
    --name "ACM-Certificate-Renewal-Issues" \
    --event-pattern '{
        "source": ["aws.health"],
        "detail-type": ["AWS Health Event"],
        "detail": {
            "service": ["ACM"],
            "eventTypeCategory": ["scheduledChange", "issue"]
        }
    }' \
    --region us-east-1

# Add SNS target for notifications
aws events put-targets \
    --rule "ACM-Certificate-Renewal-Issues" \
    --targets "Id"="1","Arn"="arn:aws:sns:us-east-1:ACCOUNT:acm-certificate-alerts" \
    --region us-east-1

# Create CloudFront distribution configuration
aws cloudfront create-distribution \
    --distribution-config '{
        "CallerReference": "ssl-setup-2026",
        "Comment": "Production distribution with ACM SSL",
        "Enabled": true,
        "Origins": {
            "Quantity": 1,
            "Items": [{
                "Id": "primary-origin",
                "DomainName": "origin.example.com",
                "CustomOriginConfig": {
                    "HTTPPort": 80,
                    "HTTPSPort": 443,
                    "OriginProtocolPolicy": "https-only",
                    "OriginSslProtocols": {
                        "Quantity": 1,
                        "Items": ["TLSv1.2"]
                    }
                }
            }]
        },
        "DefaultCacheBehavior": {
            "TargetOriginId": "primary-origin",
            "ViewerProtocolPolicy": "redirect-to-https",
            "AllowedMethods": {
                "Quantity": 2,
                "Items": ["GET", "HEAD"]
            },
            "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6"
        },
        "ViewerCertificate": {
            "ACMCertificateArn": "arn:aws:acm:us-east-1:ACCOUNT:certificate/CERT-ID",
            "SSLSupportMethod": "sni-only",
            "MinimumProtocolVersion": "TLSv1.2_2021"
        },
        "Aliases": {
            "Quantity": 2,
            "Items": ["example.com", "www.example.com"]
        }
    }'

# After CloudFront deployment completes (5-15 minutes)
# Copy the CloudFront domain name: d123456789.cloudfront.net

# Route 53: Create ALIAS record for apex domain
aws route53 change-resource-record-sets \
    --hosted-zone-id Z1234567890ABC \
    --change-batch '{
        "Changes": [{
            "Action": "UPSERT",
            "ResourceRecordSet": {
                "Name": "example.com",
                "Type": "A",
                "AliasTarget": {
                    "HostedZoneId": "Z2FDTNDATAQYW2",
                    "DNSName": "d123456789.cloudfront.net",
                    "EvaluateTargetHealth": false
                }
            }
        }]
    }'

# Create CNAME for www subdomain
aws route53 change-resource-record-sets \
    --hosted-zone-id Z1234567890ABC \
    --change-batch '{
        "Changes": [{
            "Action": "UPSERT",
            "ResourceRecordSet": {
                "Name": "www.example.com",
                "Type": "CNAME",
                "TTL": 300,
                "ResourceRecords": [{"Value": "d123456789.cloudfront.net"}]
            }
        }]
    }'

#!/bin/bash
# SSL Certificate Validation Script

DOMAIN="example.com"

echo "=== SSL Certificate Validation ==="

# Test HTTPS connection
echo -e "\n1. Testing HTTPS connection..."
curl -sI "https://${DOMAIN}" | head -5

# Check certificate details
echo -e "\n2. Certificate details..."
echo | openssl s_client -connect ${DOMAIN}:443 -servername ${DOMAIN} 2>/dev/null | \
    openssl x509 -noout -subject -issuer -dates

# Verify certificate chain
echo -e "\n3. Certificate chain..."
echo | openssl s_client -connect ${DOMAIN}:443 -servername ${DOMAIN} 2>/dev/null | \
    grep -E "^(Certificate chain| [0-9]+ s:)"

# Check TLS version
echo -e "\n4. TLS version in use..."
echo | openssl s_client -connect ${DOMAIN}:443 -servername ${DOMAIN} 2>/dev/null | \
    grep "Protocol  :"

# Test HTTP to HTTPS redirect
echo -e "\n5. HTTP redirect test..."
curl -sI "http://${DOMAIN}" | grep -E "^(HTTP|Location)"

echo -e "\n=== Validation Complete ==="