New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Replaced cert on LB listener still keeps previous cert association on LB #25652
Comments
aws_lb_listener
: New cert added without removing old cert's SNI thus requiring clickops to remove cert assoc.
same issue noticed during the certificate replacement. ( new ARN ) |
I have the same issue, is there any way to fix it? |
@VuxLuan - basically the default ( main ) certificate that was previously there was moved from default to be a listener certificate. You can delete this old certificate. the "describe-listeners" API call only shows the DEFAULT NLB certificate in use by the listeners. That API call does Not show the additional "Listener certificates for SNI" in use by the Listener. To get a list of all the certificates being used, use the API call "describe-listener-certificates" instead. Alternatively, you can also remove the non-default certificates on the console by following the procedure below: |
@pmozdzynskiwh - Sure, doing this manually after running "terraform apply" is one way to do it, but I think we're all looking for a way to have terraform do it for us. I work in a system that requires separation of duties, so being able to script the deployment manager's operations is preferred. |
I just ran into this issue as well. Is there any progress on this? |
Community Note
Terraform CLI and Terraform AWS Provider Version
Affected Resource(s)
aws_lb_listener
aws_lb
Terraform Configuration Files
Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.
Debug Output
N/A
Panic Output
N/A
Expected Behavior
The cert should be replaced on the listener and the old referenced SNI should be removed so the old cert can be removed.
Actual Behavior
The cert was replaced on the listener and the old referenced SNI remained. This then required me to clickops delete the SNI from each load balancer in order to get the old cert to be unassociated so the old cert could be removed.
Steps to Reproduce
terraform apply
Important Factoids
I'm unsure if the API supports this.
From the aws elbv2 modify-listener documentation, it looks like the
--certificates
can be used to replace all of the SNI certs and set one as the default. I'd prefer if we could keep the--certificates
as a single cert. I suppose this would point to theaws_lb
resource.References
The text was updated successfully, but these errors were encountered: