Per-Entity Metadata Working Group

[Patrick Radtke <>]

On Thu, Oct 13, 2016 at 12:31 PM, Tom Scavo 
<>
 wrote:
>> It's user managed, you configure from the AWS Console or command line for
>> each custom domain you wish to serve.
>
> Sorry, I forgot you are new to the group. Patrick and others have
> mentioned that some CDNs will retrieve the TLS key via a secure
> channel, thereby precluding the need to store the key in the
> filesystem.
>
> Does your CDN have this feature? (this is an indispensable feature IMO)

Cloudfront (and AWS in general) has two options for managing your own keys:
1) Amazon can create and manage a key for your domain. You never see
the key, and only approve it (they send an email to admin@domainname
to request approval). Amazon then manages renewals. These are DV
certs, and are considered valid by all major browsers. I'm not sure
what the compatibility is for things other than browsers.
2) Bring your own key. You upload it securely to cloudfront. You have
no access or ability to download the key from cloud front. You have to
manage renewals yourself.

-Patrick