Services Plugins FAQs

AWS changing SSL certificate

Plugins
#1

Hello,

I use the Zerocode AWS file uploader plugin for Bubble and want to know if the statement from Amazon listed below will effect my usage of your plugin.

Thank you,

John

Hello, This is a reminder that Amazon Simple Storage Service (S3) and Amazon CloudFront are both migrating their services’ certificates from DigiCert to Amazon Trust Services starting March 23, 2021. If you do not send HTTPS traffic directly to your S3 bucket, or only use custom domains like www.example.com with your CloudFront distribution, then there is no impact and you can disregard this message. If you do send HTTPS traffic directly to your S3 bucket, or use CloudFront domains covered by *.cloudfront.net, please continue reading and review the FAQ below on which certificates are migrating. The Amazon Trust Services Certificate Authority originates from AWS’ purchase of the Starfield Services Certificate Authority which has been valid since 2005. This means you shouldn’t have to take any action to use the certificates issued by Amazon Trust Services as it is already included in common trust stores across most web browsers, operating systems, and applications. However, if you build custom certificate trust stores or use certificate pinning, you may need to alter your configurations. As a best practice, we recommend verifying Amazon Trust Services is in your trust store with one of the following tests. [1] Visit our blog at https://aws.amazon.com/blogs/security/how-to-prepare-for-aws-move-to-its-own-certificate-authority/ and use the test URLs there. [2] Fetch the object from https://s3-ats-migration-test.s3.eu-west-3.amazonaws.com/test.jpg and verify a 200 response or that you see the green check mark in the test image. [3] Create an S3 bucket in any of the following AWS regions and confirm you can fetch a test object over HTTPS: EU-WEST-3, EU-NORTH-1, ME-SOUTH-1, AP-NORTHEAST-3, AP-EAST-1, and US-GOV-EAST-1. If Amazon Trust Services is not in the trust store, browsers will display an error message like https://untrusted-root.badssl.com/ and applications will show an application-specific error. If any of the tests fail, you must do one or more of the following actions: [A] Upgrade your operating system or browser that you are using, [B] Update your application to use CloudFront with a custom domain name and your own certificate, or [C] if you are using custom certificate trust stores or certificate pinning, include Amazon Trust Services’ Certificate Authorities, see https://www.amazontrust.com/repository/. If you have additional questions, or require additional assistance, please open a case in the AWS Support Center at https://aws.amazon.com/support. Frequently Asked Questions Q1: Which CloudFront certificate is migrating? CloudFront’s global wildcard *.cloudfront.net Q2: Which S3 certificates are migrating? S3 has several regional certificates, and its global wildcard certificate, migrating in the following AWS regions: Global wildcard *.s3.amazonaws.com in AP-NORTHEAST-1, AP-NORTHEAST-2, AP-NORTHEAST-3, AP-SOUTH-1, AP-SOUTHEAST-1, AP-SOUTHEAST-2, CA-CENTRAL-1, EU-CENTRAL-1, EU-NORTH-1, EU-WEST-1, EU-WEST-2, EU-WEST-3, SA-EAST-1, US-EAST-1, US-EAST-2, US-WEST-1, US-WEST-2 Regional wildcard *.s3.region.amazonaws.com in AP-NORTHEAST-1, AP-NORTHEAST-2, AP-SOUTH-1, AP-SOUTHEAST-1, AP-SOUTHEAST-2, CA-CENTRAL-1, CN-NORTH-1, CN-NORTHWEST-1, EU-CENTRAL-1, EU-WEST-1, EU-WEST-2, SA-EAST-1, US-EAST-1, US-EAST-2, US-GOV-WEST-1, US-WEST-1, US-WEST-2 FIPS wildcard *.s3-fips-us-gov-west-1.amazonaws.com in US-GOV-WEST-1 Sincerely, Amazon Web Services Amazon Web Services, Inc. is a subsidiary of Amazon.com, Inc. Amazon.com is a registered trademark of Amazon.com, Inc. This message was produced and distributed by Amazon Web Services Inc., 410 Terry Ave. North, Seattle, WA 98109-5210

#2

Hello @socialmedia

Thanks for reaching out!

As far as we know, this is not related to plugin per se. Believe this statement relates to applications using S3 Services, and their SSL implementation.
The plugin is a simple bridge between app and the s3 storage, while the connection itself will be secured.

I would recommend you to follow their instruction if any needed, and maybe also check with bubble or amazon teams for further clarification.

Hope this helps. :pray:

Regards,
Dumitru

Amazon s3 warning
#3

This really does not help!

I asked my developer about this and he suggested I ask you (Zerocode) directly which I have.

If I were to ask Amazon or Bubble the response by both would be the same. Have you contacted the plugin creator and what did they say?

Amazon is even more difficult because you can’t speak with a human directly and if you want help you need to speak with a third party vendor and they certainly do not know Bubble or Zerocode!

Sorry to say this doesn’t help. Why exactly is it that Zerocode would not know with 100% certainty if there will be issues or not? If this effects my business I need to know about it before it really becomes a problem if at all!

JOhn

#4

Hello @socialmedia

As I’ve said in previous post, we rely on both sides connections to be secured. Meaning if the SSL is correctly set the plugin will establish the secure connection between both sides, that’s it.

As you’ve read the Amazon’s message:

We can not interfere on , as there is nothing to be done within plugin.

Regards,
Dumitru

#5

Are you saying that I will not have an issue with 100% certainty? If not, where is the danger?

What means “We can not interfere on” ?

Thanks

#6

I understand the concern you’re having with the changes above, but the position which we are at the moment is there nothing to be done at the plugin since we do not have access to either side’s backends. Their policy is their policy, we will monitor this of course for further development. As we rely on both sides connections to be secured, the plugin will work.

Sorry seems like I forgot to add, as we can not interfere on the changes which are going to happen to Amazon we can not do anything within plugin.

Hope this answers your question.

Best,
Dumitru

#7

Do you mean now that there is a potential problem?

#8

No, I haven’t said anything about a “potential problem” , what it is done on their side it is their decision that’s it.
We follow this message and we will work towards providing the required support for any of your concerns regarding the plugin workload if and it is a big “IF”, there are gonna be any changes related which will affect the plugin, we will look into it.

As I’ve mentioned we can not do anything at the moment, for more details as I recommend you is to check with Bubble and Amazon teams respectively as pretty much Bubble relies on AWS for their entire infrastructure and our plugin is a simple bridge between the two.

Regards,
Dumitru

#9

You place a very strong degree of ‘hardness’ and ‘emphasis’ on the terminology quoted above! It is this wording and choice of words you use and describe that draws attention to the fact that not everything may be sunshine, rainbows and lollipops!

I prefer to counter and avoid problems rather be left in the cold!

#10

I believe everyone would love to avoid any problems related to whatever scary messaging is provide by another company, however as we see it at the moment we can not do anything.

As this is, why I’m asking for your understanding on the matter and follow their guideline. It is much clear in the messaging Amazon provided in the letter that this affects applications using S3 either Bubble or any other who relies on it.

You can see what they instruct to do:

If you do not send HTTPS traffic directly to your S3 bucket, or only use custom domains like www.example.com with your CloudFront distribution, then there is no impact and you can disregard this message.

Alternatively:

If you do send HTTPS traffic directly to your S3 bucket, or use CloudFront domains covered by *.cloudfront.net, please continue reading and review the FAQ below on which certificates are migrating. The Amazon Trust Services Certificate Authority originates from AWS’ purchase of the Starfield Services Certificate Authority which has been valid since 2005. This means you shouldn’t have to take any action to use the certificates issued by Amazon Trust Services as it is already included in common trust stores across most web browsers, operating systems, and applications. However, if you build custom certificate trust stores or use certificate pinning, you may need to alter your configurations.

So I do not think we can move forward and do anything related to SSL at the moment.

Thanks for understanding. :pray:

Regards
Dumitru