AWS: "Unable to parse certificate. Please ensure the certificate is in PEM format."

Question

I am trying to update a wildcard certificate for EC2 instances on AWS. The service these servers belong to consists of a single server and a set of servers behind AWS ELB.

The certificate has been successfully updated and verified on the single server.

The same is true for an instance pulled up from the image the ELB uses for AutoScaling.

However, when trying to add a new certificate to the load-balancer, I get the above error. I'm sure the certificate is correct and is in PEM format. I first tried via the web console, then using the aws aim command line tools with the same result.

Anyone came across similar issue recently?

Solution 1

Just ran into the same exact issue: web console and AWS CLI reporting the same error in not being able to parse the certificate.

The error's root cause turned out to be in the private key -- converting my private key to a "RSA PRIVATE KEY" fixed the issue:

openssl rsa -in server.key -out server.key.rsa

Then, use the server.key.rsa in the private key field and leave the public cert as is.

Solution 2

The AWS CLI requires file:// prefix for local files. For example file://private.key, file://cert_file, etc.

Solution 3

According to installation steps of ZeroSSL you have to copy all the content of the private.key after opening it in notepad.

The private key must start with -----BEGIN RSA PRIVATE KEY----- and end with -----END RSA PRIVATE KEY-----

I did that also with certificate.crt and the problem solved and saved successfully

Solution 4

I just spent the last hour struggling with this issue, on the web console. For sake of documenting, I would like to share what fixed the problem for me:

1. Ensure all keys and certs to be in RSA (as is demonstrated in Vikram's answer)
2. Ensure the ---- TEXT HERE ---- start and end labels are included in what you are uploading/copy-pasting into the web-console
3. My issue was: The RapidSSL certificates I'd purchased on Name.com, when copy-pasted into an Evernote, resulted in the conversion of newlines into spaces. I only realized this when I inputted the text into Vim, and the monospaced text wasn't aligned properly. After a series of f, [space], a, [return], I'd fixed the file in Vi and it now seems to be working. AWS' interface should be smart enough to recover from common errors such as this - nevertheless, this fixed the issue for me.

Hope this helps save an hour for somebody else :)

View more solutions

Comments

[marekful]

Turned out to be the same issue here. Their error message is, to say, not too informative. Actually is bullshit. The key is valid so it can be parsed and is in the format they require (PEM). But it has been generated with an algorithm they don't accept.

[t q]

im getting WARNING: can't open config file: /etc/pki/tls/openssl.cnf

[David van Dugteren]

Care to elaborate at all there?

[Patrick Seymour]

Sounds strange, but this suggestion worked for me. Originally was getting the exact error message as the title of this Question, but adding file:// to each filename made the upload work perfectly. Used the Windows x64 MSI AWS CLI installer, and using cmd to execute. Replace X with your certificate name. aws iam upload-server-certificate --server-certificate-name X --certificate-body file://cert.crt --private-key file://key.key --certificate-chain file://chain.crt --path /cloudfront/X/

[Joseph Lust]

Same problem on Linux, fixed with the file prefix. Stupid me for not reading the official docs, but rather reading a wonderfully misleading blog post.

[svintus]

Thank you, I was going absolutely bonkers until I found your answer.

[Tebam]

It didn't solved it for me, the output file is exactly the same one

[Tudor Ravoiu]

For every Mac user out there. The "file://" prefix should indeed be used before the certificate file name. For some reason, I thought this is necessarily only for Windows.

[Cerin]

This just gives me the error: 140186932995736:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:701:Expecting: ANY PRIVATE KEY