Amazon S3 and Amazon CloudFront migrating service certificates to Amazon Trust Services

user_13441233 0
Viewed 1173

I have received an email from AWS regarding S3 and Cloudfront migration. However, I am not quite sure if I need to take any action for this. Can anyone please help me

This is a reminder that Amazon Simple Storage Service (S3) and Amazon CloudFront are both migrating their services’ certificates from DigiCert to Amazon Trust Services starting March 23, 2021. If you do not send HTTPS traffic directly to your S3 bucket, or only use custom domains like www.example.com with your CloudFront distribution, then there is no impact and you can disregard this message. If you do send HTTPS traffic directly to your S3 bucket, or use CloudFront domains covered by *.cloudfront.net, please continue reading and review the FAQ below on which certificates are migrating.

So, here is how I use my S3 bucket:

  1. I host a few static websites and they are hosted on S3 buckets these have proper domains and use CloudFront distribution.
  2. I have a few buckets where I store some images/videos and I use the source links(https://xxx.s3-ap-southeast-1.amazons.com) in my other websites to load resources.
  3. I have a few staging websites and they are hosted on S3 so they all have temporary URLs such as http://xxx.s3-website.aws.com

Thanks for your help in advance.

amazon-s3
4 Answers
  1. I host a few static websites and they are hosted on S3 buckets these have proper domains and use CloudFront distribution.

If you are not directly visiting *.cloudfront.net, then you will not be impacted in this case since S3 website endpoint only supports HTTP (no S).

  1. I have a few buckets where I store some images/videos and I use the source links(https://xxx.s3-ap-southeast-1.amazons.com) in my other websites to load resources.

You are impacted in this case.

  1. I have a few staging websites and they are hosted on S3 so they all have temporary URLs such as http://xxx.s3-website.aws.com

You will not be impacted since you are using HTTP (no S) only.

user_106924930

The email also states

The Amazon Trust Services Certificate Authority originates from AWS’ purchase of the Starfield Services Certificate Authority which has been valid since 2005. This means you shouldn’t have to take any action to use the certificates issued by Amazon Trust Services as it is already included in common trust stores across most web browsers, operating systems, and applications. However, if you build custom certificate trust stores or use certificate pinning, you may need to alter your configurations. As a best practice, we recommend verifying Amazon Trust Services is in your trust store with one of the following tests.

meaning, if you don't build custom certificate trust stores, or use certificate pinning, you don't need to alter anything. When visiting impacted HTTPS pages, you or other users won't notice the change of certificate.

More about certificate pinning here

user_23785830

for your point 2. my understanding is that if you are just linking to the hosted https bucket versions they will just be updating the certificates from digicert to amazon issued and everything should just keep working.

i have a similar setup with videos and images hosted using the digicert certificate on s3. i just duplicated my dev environment to use "eu-west-3" which has the latest Amazon issued certificates and everything seemed the same, just different issuers. Maybe this was more clear to people with better knowledge however i can only assume they will just reissue new certificates and there will be no impact to those of us who were using the old digicert ones.

user_152105100

I'm in the same situation.

What I did?

With this occasion I'm moving all s3 assets publicly accessed via s3.amazonaws.com under cloud front with Route 53, I'm tired of fixing and checking links every now and then and I'm no longer tied to aws for shared resources, if tomorrow I migrate to Google is just a domain swap.

What is expected?

This does not means we no longer have access to s3 or cloud front https, we do, but we need to make sure that our OS, App, Browser or framework supports Amazon Trust Services CAs.

Easier said than done, bellow text take from aws blog.

As long we run bellow versions or higher we are safe

  • Microsoft Windows versions, that have updates installed, from January 2005, Windows Vista, Windows 7, Windows Server 2008, and newer versions
  • Mac OS X 10.4 with Java for Mac OS X 10.4 Release 5, Mac OS X 10.5 and newer versions
  • Red Hat Enterprise Linux 5 (March 2007), Linux 6, and Linux 7 and CentOS 5, CentOS 6, and CentOS 7
  • Ubuntu 8.10
  • Debian 5.0
  • Amazon Linux (all versions)
  • Java 1.4.2_12, Java 5 update 2, and all newer versions, including Java 6, Java 7, and Java 8

All modern browsers trust Amazon’s CAs. You can update the certificate bundle in your browser simply by updating your browser. You can find instructions for updating the following browsers on their respective websites:

If your application is using a custom trust store, you must add the Amazon root CAs to your application’s trust store. The instructions for doing this vary based on the application or platform. Please refer to the documentation for the application or platform you are using.

TL;DR

Check this link to see how are you affected by CloudFront & S3 migrating default certificates to Amazon Trust Services March 23rd 2021 from DigiCert

user_38984950
Related