如何为 AWS::ElasticLoadBalancingV2::Listener 设置多个证书

Question

嗨，我在为 ALB 侦听器设置多个证书时遇到问题。这是我的 CF 模板的片段：

  DiscoveryListenerHTTPS:
    Type: AWS::ElasticLoadBalancingV2::Listener
    DependsOn:
      - DiscoveryLoadBalancer
      - DiscoveryLoadBalancerTargetGroup
    Properties:
      Certificates:
       - CertificateArn: !Ref CertificateArn1
       - CertificateArn: !Ref CertificateArn2

和回应是： Up to '1' certificate ARNs can be specified, but '2' were specified (Service: AmazonElasticLoadBalancingV2; Status Code: 400; Error Code: TooManyCertificates; Request ID: XXXXXXXXX)

Answer 1

这对我有用，是使用默认证书的 443 端口侦听器的示例，然后是具有至少一个证书并与先前创建的侦听器关联的证书列表：

  Listener443:
    DependsOn:
    - LoadBalancer
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      Certificates:
        - CertificateArn: !Ref CertificateARN
      LoadBalancerArn: !Ref LoadBalancer
      DefaultActions:
        - Type: fixed-response
          FixedResponseConfig:        
            ContentType: text/plain
            MessageBody: "Not Found"
            StatusCode: 404
      Port: 443
      Protocol: HTTPS

  CertificatesList:
    Type: AWS::ElasticLoadBalancingV2::ListenerCertificate
    Properties: 
      Certificates: 
        - CertificateArn: !Ref CertificateARN2
      ListenerArn: !Ref Listener443

Answer 2

它有点笨重；用于创建侦听器的 CF 模板仅设置默认证书。

您应该能够使用此对象向侦听器添加其他证书：https : //docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-listenercertificate.html

Answer 3

来到这里寻找相同的答案。发现评论/答案中没有明确给出答案，所以我会这样做。虽然您可以为一个HTTPS监听指定多个SSL证书，但您不能直接在CFN模板中为HTTPS监听资源指定多个证书。您必须在模板中为其他证书创建另一个资源，如下所示：

AdditionalListenerCertificates:
        Type: AWS::ElasticLoadBalancingV2::ListenerCertificate
        Properties:
            Certificates:
              - CertificateArn: !Join
                - ":"
                - - "arn:aws:acm"
                  - !Ref AWS::Region
                  - !Ref AWS::AccountId
                  - !Join ["/", ["certificate", "<you-certificate-id>"]]
            ListenerArn: !Ref HTTPSListener