How to access a certification from AWS in a ASP.NET (Core 2) web application?

user_1616049 0
Viewed 1470

I am trying to deploy an ASP.NET Core 2 web application to AWS Elastic Beanstalk.

The application is actually IdentityServer4 for which I need to have access to a certification to sign and validate tokens.

There is a tutorial how to configure the use of certificates for Azure web applications HERE but I haven't found anything similar for AWS.

Whatever I search about AWS and its certificates, I always find articles and documentation about SSL/TLS connections for HTTPS. I am aware on how to do that and will do that separately, I already have a cert available in AWS Certificate Manager and I can set it in Elastic Beanstalk for the Load Balancer but ACM documentation states that:

  • ACM does not provide certificates for anything other than the SSL/TLS protocols.
  • You cannot use ACM Certificates for code signing or email encryption.

So if I want to use a cert in my code, it seems ACM Cert is not meant for that.

I can create a self-signed certificate with OpenSSL but I don't know what's the best way to access it from my ASP.NET Core 2 web application inside the Elastic Beanstalk instance. I can't put the certificate file in my code repository, I want to inject it to the environment through the AWS somehow but I don't know where or how can I access it in my application?

aws-certificate-manager identityserver4 asp.net-core amazon-web-services certificate
1 Answers

I lost some time searching for that too.

What I ended up doing was to store a base64 of the certificate and the certificate password in Secrets Manager and read in the app at Startup with Kralizek's AWSSecretsManagerConfigurationExtensions.

private X509Certificate2 CreateSigningCredential()
{
    if (_signingCertificate != null)
        return _signingCertificate;

    var certBytes = Configuration.GetValue<string>("Auth:Certificate");
    if (string.IsNullOrEmpty(certBytes))
    {
        return null;
    }

    var password = Configuration.GetValue<string>("Auth:CertificatePassword");
    if (string.IsNullOrEmpty(password))
    {
        return null;
    }

    var certificate = Convert.FromBase64String(certBytes);
    _signingCertificate = new X509Certificate2(certificate, password);

    return _signingCertificate;
}
user_59297270
Related