Now let's review SSL certificates.
Within AWS, we have the ability to
import or create certificates
with the AWS Certificate Manager.
So, the Certificate Manager does allow us to create
free SSL certificates including wildcards.
Now, the certificates that are created within
the certificate Manager will automatically renew.
And because Starfield is the root authority,
Amazon is an intermediate authority, then these certificates
are trusted in the major browsers and clients.
Now, we can import existing certificates.
If you already have certificates that you've purchased
and created through something like Verisign or Komodo,
then you can import those,
but it's important to keep in mind that
the certificate manager will not be able to renew those.
You can renew them at Verisign or Komodo,
wherever they are, and then re-import them and replace
those certificates in the certificate manager.
Either way, wherever your certificates come from,
the certificate manager can automatically deploy
those certificates to your Elastic Load Balancers,
to your CloudFront distributions,
to API Gateways.
And so the great benefit of that is that
we no longer have to really be worried about
the underlying drudgery
of having to renew and re-key
and re-deploy those certificates
to our various servers and applications.
So, I have done plenty of that in my career, and
it's not hard re-keying a certificate that expires
and downloading a new certificate and then ensuring that
that certificate is installed in Apache or Nginx,
or something that's configured.
It's not hard but it is tedious,
and it's one of those things that's fun the first time,
then just quickly becomes a chore, right?
So we can get away from all of that by using something
like the Certificate Manager.
Here, you can see that we have several different components.
We have a CloudFront up here.
We have our CloudFront edge location,
and we have our Load Balancer.
We have an EC2 instance, and of course we have
the API Gateway.
The certificate manager, like we've said, can deploy
our certificates directly to CloudFront edge locations.
It can deploy certificates to our load balancer,
and to API Gateway.
Now, in many times, you need true end to end encryption.
If your users are going through CloudFront,
through your Load Balancer, to your back-end instance,
then we need, in many cases,
like for PCI Compliance or other types of
legal or regulatory compliance,
we need end to end encryption.
It's important to keep in mind that the certificate manager
cannot deploy certificates to EC2.
It's also worth noting that of course,
our users and their clients will require for that connection
between the users and CloudFront, browsers would require
a trusted certificate.
Between CloudFront and our EC2 instance,
CloudFront would require...
or between CloudFront and API Gateway, that connection
would also require a trusted certificate.
Between the load balancer and EC2, by default,
the load balancer does not require a trusted certificate.
It is possible to script as these EC2 instances
come to life, if you're using something like auto-scaling.
As these instances come to life, you can script them
to create their own self-signed certificate.
That way, you don't have to worry about getting
your trusted certificate stored somewhere
and then deployed to it.
They can just create their own self-signed certificate.
It would technically be untrusted, but again,
this connection between the load balancer
and the EC2 instance by default does not care.
It will accept that untrusted certificate.
So, keep that in mind that if you have a need
to create and deploy SSL certificates,
and you want to ensure those are always renewed
and always deployed to various locations,
then keep the Amazon Certificate Manager in mind