https - 从 self 管理的 Let's Encrypt 到 AWS Certificate Manager

Question

我一直在为一个域管理 Let's Encrypt 的 SSL 证书。

现在我正在转向 Amazon API 网关。我将使用 AWS Certificate Manager 为根域和一堆子域生成 HTTPS 证书。

如果我进行了转移，与我的域关联的当前 HTTPS 证书会发生什么变化。如果浏览器突然开始看到一个域的新 HTTPS 证书，而到目前为止他们一直在为该域获得不同的 HTTPS 证书，这会是一个问题吗？

此外，一旦我进行了转变，我该如何处理我当前(手动管理的)Let's Encrypt 证书？有没有办法永久取消它？

Answer 1

Szabolcs Dombi说

You can have multiple valid certificates for the same domain at the same time. Moving from one certificate issuer to another should not cause a problem.

Toby Osbourn说

SSL certificates don’t last forever, most of them need to be renewed on a yearly cycle and occasionally you will want to change the type of the SSL certificate mid-cycle.

由于您正在更换证书，我建议您备份您拥有的证书。

备份旧证书后，只需覆盖 .crt和 .key文件与您的新文件。然后，重新加载您的 Web 服务器，以便它知道查看这些新证书，您就可以开始了。

如果您有兴趣了解有关如何使用 Amazon Certificate Manager (ACM) 生成 SSL 证书的更多信息，我建议您使用 Barguzar, A. (July 2018). Building Serverless Python Web Services with Zappa .在那里可以阅读一份很好的分步指南。请参阅下面的摘录:

ACM is a service that manages and creates SSL/TSL certificates for AWS-based services and applications. An ACM certificate works with multiple domain names and subdomains. You can also use ACM to create a wildcard SSL.

ACM is strictly linked with AWS Certificate Manager Private Certificate Authority (ACM PCA). ACM PCA is responsible for validating the domain authority and issuing the certificate.