Skip to main content

AWS Certificate Rotation Playbook (ALB + CloudFront)

Use this customer-facing playbook when you need to rotate or replace TLS certificates in your AWS BYOC deployment of Digital Twin.

Common triggers:

  • Certificate expiration is approaching
  • Your organization is rotating CAs or private keys
  • You need to add or change domains/SANs
Need help?

If you want Viven to coordinate the change window with your team, contact your Viven representative or support@viven.ai.

Scope​

This playbook covers both certificates used in AWS BYOC:

  1. Regional ACM certificate in your deployment region (for Application Load Balancer)
  2. Global ACM certificate in us-east-1 (for CloudFront)

Prerequisites​

Before you start:

  • You have AWS permissions to manage ACM, ELBv2, and CloudFront
  • You have the new certificate(s) ready to request or import
  • DNS validation owners are available (if ACM DNS validation is used)
  • You have identified your:
    • ALB ARN or name
    • ALB HTTPS listener ARN (typically 443)
    • CloudFront distribution ID
  • You have a rollback plan (keep the current certificates active until validation is complete)

Step 1: Create or import the new certificates in ACM​

Create/import both certificates first:

1A) Regional certificate (for ALB)​

  • Region: same region as your ALB
  • Covers your stage and production hostname(s)
  • Include wildcard entries (for example, *.yourdomain.com) if wildcard routing is your standard

1B) Global certificate (for CloudFront)​

  • Region: us-east-1
  • Covers the stage and production CloudFront-facing hostname(s) used by your distribution
note

CloudFront can only use ACM certificates from us-east-1.

After requesting/importing, wait until each certificate status is Issued.

Step 2: Update the ALB listener certificate​

Apply the following steps to all Digital Twin load balancers and their in-scope HTTPS listeners.

  1. Open AWS Console → EC2 → Load Balancers
  2. Select a Digital Twin load balancer
  3. Open Listeners and rules
  4. Select HTTPS listener (for example 443)
  5. Choose Manage certificates
  6. Add/select the new ACM certificate
  7. Set it as the certificate used for inbound TLS
  8. Save changes
  9. Repeat for the next Digital Twin load balancer/listener until all are updated
Important for multi-LB deployments

This rotation is complete only after the certificate is updated for every in-scope Digital Twin load balancer and HTTPS listener.

Optional CLI example:

aws elbv2 modify-listener \
  --listener-arn <alb-listener-arn> \
  --certificates CertificateArn=<new-regional-certificate-arn> \
  --region <your-deployment-region>

Step 3: Update the CloudFront viewer certificate​

Apply the following steps to all in-scope Digital Twin CloudFront distributions.

  1. Open AWS Console → CloudFront
  2. Select a Digital Twin distribution
  3. Choose Edit
  4. In Settings, locate Custom SSL certificate
  5. Select the new ACM certificate from us-east-1
  6. Save changes
  7. Wait for distribution status to return to Deployed
  8. Repeat for the next Digital Twin distribution until all are updated
note

CloudFront updates are global and may take several minutes before all edge locations serve the new certificate.

Important for multi-distribution deployments

This rotation is complete only after the certificate is updated for every in-scope Digital Twin CloudFront distribution.

Step 4: Validate the new certificates​

Run post-change validation for both paths:

  • Browser validation on production URL(s)
  • API/UI smoke tests for login and core pages
  • TLS metadata check (subject/issuer/validity dates), for example:
echo | openssl s_client -connect digitaltwin.yourdomain.com:443 -servername digitaltwin.yourdomain.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Confirm:

  • Certificate subject/SAN matches expected domain(s)
  • notAfter reflects the new certificate validity window
  • No TLS warnings in browser or synthetic checks

Step 5: Rollback plan (if needed)​

If validation fails:

  1. Re-attach the previous certificate on the ALB listener
  2. Re-select the previous certificate on CloudFront
  3. Re-validate service health
  4. Open a support case with Viven including timestamps and impacted domains

Step 6: Cleanup​

After successful cutover and a stabilization window:

  • Remove old certificates from active listeners/distributions
  • Keep retired certs per your audit/retention policy, then delete from ACM
  • Update your internal certificate inventory/expiry alerts

Operational recommendations​

  • Rotate certificates at least 2-4 weeks before expiration
  • Avoid changing ALB and CloudFront certs during peak traffic windows
  • If your deployment is managed jointly with Viven, notify Viven before production rotation