Skip to content
AWS for Query.Farm

aws.lightsail.get_load_balancer_tls_certificates

Example SQL Queries

SELECT * FROM
aws.lightsail.get_load_balancer_tls_certificates
WHERE
"load_balancer_name" = 'VALUE';

Description

Returns information about the TLS certificates that are associated with the specified Lightsail load balancer.

TLS is just an updated, more secure version of Secure Socket Layer (SSL).

You can have a maximum of 2 certificates associated with a Lightsail load balancer. One is active and the other is inactive.

Table Definition

Column NameColumn Data Type
load_balancer_name Required Input Column

The name of the load balancer you associated with your SSL/TLS certificate.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
tls_certificates

An array of LoadBalancerTlsCertificate objects describing your SSL/TLS certificates.

STRUCT(
    "name" VARCHAR,
    "arn" VARCHAR,
    "support_code" VARCHAR,
    "created_at" TIMESTAMP_S,
    "location" STRUCT(
        "availability_zone" VARCHAR,
        "region_name" VARCHAR
    ),
    "resource_type" VARCHAR,
    "tags" STRUCT(
        "key" VARCHAR,
        "value" VARCHAR
    )[],
    "load_balancer_name" VARCHAR,
    "is_attached" BOOLEAN,
    "status" VARCHAR,
    "domain_name" VARCHAR,
    "domain_validation_records" STRUCT(
        "name" VARCHAR,
        "type" VARCHAR,
        "value" VARCHAR,
        "validation_status" VARCHAR,
        "domain_name" VARCHAR,
        "dns_record_creation_state" STRUCT(
            "code" VARCHAR,
            "message" VARCHAR
        )
    )[],
    "failure_reason" VARCHAR,
    "issued_at" TIMESTAMP_S,
    "issuer" VARCHAR,
    "key_algorithm" VARCHAR,
    "not_after" TIMESTAMP_S,
    "not_before" TIMESTAMP_S,
    "renewal_summary" STRUCT(
        "renewal_status" VARCHAR,
        "domain_validation_options" STRUCT(
            "domain_name" VARCHAR,
            "validation_status" VARCHAR
        )[]
    ),
    "revocation_reason" VARCHAR,
    "revoked_at" TIMESTAMP_S,
    "serial" VARCHAR,
    "signature_algorithm" VARCHAR,
    "subject" VARCHAR,
    "subject_alternative_names" VARCHAR[]
)[]
Show child fields
tls_certificates[]
Show child fields
tls_certificates[].arn

The Amazon Resource Name (ARN) of the SSL/TLS certificate.

tls_certificates[].created_at

The time when you created your SSL/TLS certificate.

tls_certificates[].domain_name

The domain name for your SSL/TLS certificate.

tls_certificates[].domain_validation_records[]
Show child fields
tls_certificates[].domain_validation_records[].dns_record_creation_state

An object that describes the state of the canonical name (CNAME) records that are automatically added by Lightsail to the DNS of a domain to validate domain ownership.

Show child fields
tls_certificates[].domain_validation_records[].dns_record_creation_state.code

The status code for the automated DNS record creation.

Following are the possible values:

  • SUCCEEDED - The validation records were successfully added.

  • STARTED - The automatic DNS record creation has started.

  • FAILED - The validation record addition failed.

tls_certificates[].domain_validation_records[].dns_record_creation_state.message

The message that describes the reason for the status code.

tls_certificates[].domain_validation_records[].domain_name

The domain name against which your SSL/TLS certificate was validated.

tls_certificates[].domain_validation_records[].name

A fully qualified domain name in the certificate. For example, example.com.

tls_certificates[].domain_validation_records[].type

The type of validation record. For example, CNAME for domain validation.

tls_certificates[].domain_validation_records[].validation_status

The validation status. Valid values are listed below.

tls_certificates[].domain_validation_records[].value

The value for that type.

tls_certificates[].failure_reason

The validation failure reason, if any, of the certificate.

The following failure reasons are possible:

  • NO_AVAILABLE_CONTACTS - This failure applies to email validation, which is not available for Lightsail certificates.

  • ADDITIONAL_VERIFICATION_REQUIRED - Lightsail requires additional information to process this certificate request. This can happen as a fraud-protection measure, such as when the domain ranks within the Alexa top 1000 websites. To provide the required information, use the AWS Support Center to contact AWS Support.

    You cannot request a certificate for Amazon-owned domain names such as those ending in amazonaws.com, cloudfront.net, or elasticbeanstalk.com.

  • DOMAIN_NOT_ALLOWED - One or more of the domain names in the certificate request was reported as an unsafe domain by VirusTotal. To correct the problem, search for your domain name on the VirusTotal website. If your domain is reported as suspicious, see Google Help for Hacked Websites to learn what you can do.

    If you believe that the result is a false positive, notify the organization that is reporting the domain. VirusTotal is an aggregate of several antivirus and URL scanners and cannot remove your domain from a block list itself. After you correct the problem and the VirusTotal registry has been updated, request a new certificate.

    If you see this error and your domain is not included in the VirusTotal list, visit the AWS Support Center and create a case.

  • INVALID_PUBLIC_DOMAIN - One or more of the domain names in the certificate request is not valid. Typically, this is because a domain name in the request is not a valid top-level domain. Try to request a certificate again, correcting any spelling errors or typos that were in the failed request, and ensure that all domain names in the request are for valid top-level domains. For example, you cannot request a certificate for example.invalidpublicdomain because invalidpublicdomain is not a valid top-level domain.

  • OTHER - Typically, this failure occurs when there is a typographical error in one or more of the domain names in the certificate request. Try to request a certificate again, correcting any spelling errors or typos that were in the failed request.

tls_certificates[].is_attached

When true, the SSL/TLS certificate is attached to the Lightsail load balancer.

tls_certificates[].issued_at

The time when the SSL/TLS certificate was issued.

tls_certificates[].issuer

The issuer of the certificate.

tls_certificates[].key_algorithm

The algorithm used to generate the key pair (the public and private key).

tls_certificates[].load_balancer_name

The load balancer name where your SSL/TLS certificate is attached.

tls_certificates[].location

The Amazon Web Services Region and Availability Zone where you created your certificate.

Show child fields
tls_certificates[].location.availability_zone

The Availability Zone. Follows the format us-east-2a (case-sensitive).

tls_certificates[].location.region_name

The Amazon Web Services Region name.

tls_certificates[].name

The name of the SSL/TLS certificate (my-certificate).

tls_certificates[].not_after

The timestamp when the SSL/TLS certificate expires.

tls_certificates[].not_before

The timestamp when the SSL/TLS certificate is first valid.

tls_certificates[].renewal_summary

An object that describes the status of the certificate renewal managed by Lightsail.

Show child fields
tls_certificates[].renewal_summary.domain_validation_options[]
Show child fields
tls_certificates[].renewal_summary.domain_validation_options[].domain_name

The fully qualified domain name in the certificate request.

tls_certificates[].renewal_summary.domain_validation_options[].validation_status

The status of the domain validation. Valid values are listed below.

tls_certificates[].renewal_summary.renewal_status

The renewal status of the certificate.

The following renewal status are possible:

  • PendingAutoRenewal - Lightsail is attempting to automatically validate the domain names of the certificate. No further action is required.

  • PendingValidation - Lightsail couldn't automatically validate one or more domain names of the certificate. You must take action to validate these domain names or the certificate won't be renewed. Check to make sure your certificate's domain validation records exist in your domain's DNS, and that your certificate remains in use.

  • Success - All domain names in the certificate are validated, and Lightsail renewed the certificate. No further action is required.

  • Failed - One or more domain names were not validated before the certificate expired, and Lightsail did not renew the certificate. You can request a new certificate using the CreateCertificate action.

tls_certificates[].resource_type

The resource type (LoadBalancerTlsCertificate).

  • Instance - A Lightsail instance (a virtual private server)

  • StaticIp - A static IP address

  • KeyPair - The key pair used to connect to a Lightsail instance

  • InstanceSnapshot - A Lightsail instance snapshot

  • Domain - A DNS zone

  • PeeredVpc - A peered VPC

  • LoadBalancer - A Lightsail load balancer

  • LoadBalancerTlsCertificate - An SSL/TLS certificate associated with a Lightsail load balancer

  • Disk - A Lightsail block storage disk

  • DiskSnapshot - A block storage disk snapshot

tls_certificates[].revocation_reason

The reason the certificate was revoked. This value is present only when the certificate status is REVOKED.

tls_certificates[].revoked_at

The timestamp when the certificate was revoked. This value is present only when the certificate status is REVOKED.

tls_certificates[].serial

The serial number of the certificate.

tls_certificates[].signature_algorithm

The algorithm that was used to sign the certificate.

tls_certificates[].status

The validation status of the SSL/TLS certificate. Valid values are below.

tls_certificates[].subject

The name of the entity that is associated with the public key contained in the certificate.

tls_certificates[].subject_alternative_names[]
tls_certificates[].support_code

The support code. Include this code in your email to support when you have questions about your Lightsail load balancer or SSL/TLS certificate. This code enables our support team to look up your Lightsail information more easily.

tls_certificates[].tags[]
Show child fields
tls_certificates[].tags[].key

The key of the tag.

Constraints: Tag keys accept a maximum of 128 letters, numbers, spaces in UTF-8, or the following characters: + - = . _ :/@

tls_certificates[].tags[].value

The value of the tag.

Constraints: Tag values accept a maximum of 256 letters, numbers, spaces in UTF-8, or the following characters: + - = . _ :/@