Gerenating CSR For Custom SSL On Cloudflare

Question

I need to gerenate a Certificate Signing Request (CSR) so I can obtain a wildcard certificate to upload to Cloudflare so I can enforce modern TLS(1.2+).

I'm using AWS for my application and and putting Cloudflare in front of this for extra security. My app in AWS uses certificates from AWS certificate manager which can't be exported. So I bought an SSL from a provider.

Can I generate the a CSR on my local laptop and use that to obtain the cert to upload to Cloudflare or do I need to generate the cert on my AWS loadbalancer? Can I just generate the CSR on my laptop?

The load balancers are likely to be refreshed regularly as they are part of an auto sclaing group so I don't know how I can manage this? I also don't know why it matters where I generate the CSR as I'm going to upload to Cloudflare which is independent of my infrastructure.

Answer 1

Can I just generate the CSR on my laptop?

Yes you can, just make sure to generate and use the private key that the certificate will be paired with (also follow certificate guidelines).

You can generate both the private key and the CSR using openssl (the CSR includes the public key), as according to ACM Private Key Security you will need to generate your key pair yourself if you're importing your own certificate.

At this point you have the CSR, use it to generate your certificate then import your certificate into your ACM (AWS Certificate Manager), after that you need to update the HTTPS listener in your elastic load balancer.

The load balancers are likely to be refreshed regularly as they are part of an auto scaling group so I don't know how I can manage this?

Since you have done your configuration on the ACM, the ACM should take care of default launch settings for your newly launched instances.