Installing a new SSL certificate in your ELB via CLI

For future me:

1. Create the key and CSR:

   $ openssl req -out wildcard.site.com.csr -new -newkey rsa:2048 -nodes -keyout wildcard.site.com.key
   

2. Upload the CSR to your SSL vendor (in this case, DigiCert) and obtain the signed SSL certificate.
3. Create a PEM-encoded version of the signing key. This is required for AWS/IAM certs. To check if your key is already PEM-encoded, just “head -1 site.key”. If the first line says “—–BEGIN PRIVATE KEY—–” then it’s NOT PEM-encoded. The first line should be “—–BEGIN RSA PRIVATE KEY—–“.

   $ openssl rsa -in wildcard.site.com.key -outform PEM -out wildcard.site.com.pem.key
   writing RSA key
   

4. Upload the certificate to the IAM keystore:

   $ aws iam upload-server-certificate --server-certificate-name star_site_20141014 --certificate-body file:///Users/evan/certs_20141014/site/certs/star_site_com.crt --private-key file:///Users/evan/certs_20141014/wildcard.site.com.pem.key --certificate-chain file:///Users/evan/certs_20141014/site/certs/DigiCertCA.crt
   {
       "ServerCertificateMetadata": {
           "ServerCertificateId": "XXXXXXXXXXXXXXX",
           "ServerCertificateName": "star_site_20141014",
           "Expiration": "2017-12-18T12:00:00Z",
           "Path": "/",
           "Arn": "arn:aws:iam::9999999999:server-certificate/star_site_20141014",
           "UploadDate": "2014-10-14T15:29:28.164Z"
       }
   }
   

Once the above steps are complete, you can go into the web console (EC2 -> Load Balancers), select the ELB whose cert you want to change, click the “Listeners” tab, click the SSL port (443) and select the new cert from the dropdown.