我向Amazon certificate Manager申请了一个公开签名的SSL证书"ACM"；昨天的服务。boto库方法应请求/提取证书，以便最终在我们的Web服务器上使用。这是正在使用的代码：
import logging
import boto3
from botocore.exceptions import ClientError
logger = logging.getLogger(__name__)
boto = boto3.client('acm')
domain = 'ourdomain.com'
sub_domains = None # We are using DNS validation with `*.ourdomain.com`
def request_validation(domain, alternate_domains,method):
try:
kwargs = {
'DomainName': domain }
response = boto.request_certificate(**kwargs)
certificate_arn = response['CertificateArn']
logger.info(
"Requested %s validation for domain %s. Certificate ARN is %s.",
method, domain, certificate_arn)
except ClientError:
logger.exception(
"Request for %s validation of domain %s failed.", method, domain)
raise
else:
return certificate_arn
certificate_arn = request_validation(domain, sub_domains, 'DNS')
print(f"Started validation, got certificate ARN: {certificate_arn}.")
response = None
try:
response = boto.get_certificate(CertificateArn=certificate_arn)
logger.info("Got certificate %s and its chain.", certificate_arn)
except ClientError:
logger.exception("Couldn't get certificate %s.", certificate_arn)
raise
print(response)
当运行上述操作时(在将我们的实际域替换为"ourdomain"之后(，出现以下错误：
botocore.errorfactory.RequestInProgressException：调用GetCertificate操作时发生错误(RequestInProgressException(：Certificate arn:aws:acm:us-east-2:234323424:帐户22342424中的Certificate/xxxxxx尚未颁发
以下是完整的响应：
Started validation, got certificate ARN: arn:aws:acm:us-east-2:1234234:certificate/4a2xxxx-4xxx-xxx-xxx-xxxx.
Couldn't get certificate arn:aws:acm:us-east-2:1234343:certificate/4axxxxx4-4082-xxx-xxx-xxxxx.
Traceback (most recent call last):
File "/Users/steve/git/ciderd/keys_server/experiments/aws-certs.py", line 45, in <module>
response = boto.get_certificate(CertificateArn=certificate_arn)
File "/Users/steve/miniconda3/lib/python3.7/site-packages/botocore/client.py", line 357, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/Users/steve/miniconda3/lib/python3.7/site-packages/botocore/client.py", line 661, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.errorfactory.RequestInProgressException: An error occurred (RequestInProgressException) when calling the GetCertificate operation: Certificate arn:aws:acm:us-east-2:12343234:certificate/xxxxxxafff87aa3 in account 123423423 not yet issued
Traceback (most recent call last):
File "/Users/steve/git/ciderd/keys_server/experiments/aws-certs.py", line 45, in <module>
response = boto.get_certificate(CertificateArn=certificate_arn)
File "/Users/steve/miniconda3/lib/python3.7/site-packages/botocore/client.py", line 357, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/Users/steve/miniconda3/lib/python3.7/site-packages/botocore/client.py", line 661, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.errorfactory.RequestInProgressException: An error occurred (RequestInProgressException) when calling the GetCertificate operation: Certificate arn:aws:acm:us-east-2:234323424:certificate/xxxxx in account 22342424 not yet issued
有两种可能性：
- 一切都很好，但只需要等待-就像错误所说的那样
- python代码不正确；等待"；将永远
- 证书本身有问题，所以等待可能是永远的
有没有办法确定这些可能性中的哪一种是实际情况？
- python/boto代码看起来正确吗
- 发送形式为
*.mydomain.com的ACM请求证书的mydomain.com是否正确
谢谢。
以下是如何请求证书并让ACM通过DNS验证证书的示意图(更新DNS是读者的练习(
import time
import boto3
acm = boto3.client("acm")
domain_name: str = "example.com"
request_certificate_response = acm.request_certificate(
DomainName=domain_name,
ValidationMethod="DNS",
)
certificate_arn = request_certificate_response["CertificateArn"]
# sleep to give ACM a chance to set DNS validation records
# https://github.com/aws/aws-sdk-js/issues/2133
time.sleep(10)
describe_certificate_response = acm.describe_certificate(
CertificateArn=certificate_arn,
)
certificate = describe_certificate_response["Certificate"]
domain_validation_options = certificate["DomainValidationOptions"][
0
] # should only be one!
# These are the values to shove in Route53
# domain_validation_options["ResourceRecord"]["Name"]
# domain_validation_options["ResourceRecord"]["Value"]
顺便说一句，听起来你希望能够导出私钥以将其导入服务器——这是不可能的。您最好的选择是查看Nitro Enclaves 的AWS证书管理器