Error when try to set Certificate to None in Distribution

[paulofloresjunior]

Describe the bug

Hello,
There is a problem when we try to set the ViewerCertificate of distribution in cloudfront to none like in the web console.
To make sure I'm doing the right process I did the configuration in web console with developer mode so was able to saw the REST GET to getDistributionConfig to distribution and the REST PUT to updateDistribution with ViewerCertificate changed to clear one.
I did the same in C# code as you can see below:

internal async Task RemoveCertificateFromDistribution(string cloudfrontArn, CancellationToken cToken)
{
var getDistributionRequest = new GetDistributionRequest() { Id = cloudfrontArn.GetIdFromArn() };
var dist = await amazonCloudFrontClient.GetDistributionAsync(getDistributionRequest, cToken).ConfigureAwait(false);
var viewerCertificate = new ViewerCertificate()
{
CloudFrontDefaultCertificate = false,
MinimumProtocolVersion = MinimumProtocolVersion.TLSv1
};
dist.Distribution.DistributionConfig.ViewerCertificate = viewerCertificate;
var request = new UpdateDistributionRequest() { DistributionConfig = dist.Distribution.DistributionConfig, Id = cloudfrontArn.GetIdFromArn(), IfMatch = dist.ETag };
var update = await amazonCloudFrontClient.UpdateDistributionAsync(request, cToken).ConfigureAwait(false);
return update.Distribution.DistributionConfig.ViewerCertificate.ACMCertificateArn == null;
}

Running this code I get this error message:

Amazon.CloudFront.AmazonCloudFrontException: The service returned an error with Error Code InternalError and HTTP Body:
<ErrorResponse xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/%22%3E ReceiverInternalError30bd8ada-a007-4352-a538-8d1788d861f4
---> Amazon.Runtime.Internal.HttpErrorResponseException: Exception of type 'Amazon.Runtime.Internal.HttpErrorResponseException' was thrown.
Distribution IDs or URLs:
CloudFront Request IDs(X-Amz-Cf-Id):

Expected Behavior

The response from call should be httpcode 200.

Current Behavior

Amazon.CloudFront.AmazonCloudFrontException: The service returned an error with Error Code InternalError and HTTP Body:
<ErrorResponse xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/%22%3E ReceiverInternalError30bd8ada-a007-4352-a538-8d1788d861f4
---> Amazon.Runtime.Internal.HttpErrorResponseException: Exception of type 'Amazon.Runtime.Internal.HttpErrorResponseException' was thrown.
Distribution IDs or URLs:
CloudFront Request IDs(X-Amz-Cf-Id):

Reproduction Steps

internal async Task RemoveCertificateFromDistribution(string cloudfrontArn, CancellationToken cToken)
{
var getDistributionRequest = new GetDistributionRequest() { Id = cloudfrontArn.GetIdFromArn() };
var dist = await amazonCloudFrontClient.GetDistributionAsync(getDistributionRequest, cToken).ConfigureAwait(false);
var viewerCertificate = new ViewerCertificate()
{
CloudFrontDefaultCertificate = false,
MinimumProtocolVersion = MinimumProtocolVersion.TLSv1
};
dist.Distribution.DistributionConfig.ViewerCertificate = viewerCertificate;
var request = new UpdateDistributionRequest() { DistributionConfig = dist.Distribution.DistributionConfig, Id = cloudfrontArn.GetIdFromArn(), IfMatch = dist.ETag };
var update = await amazonCloudFrontClient.UpdateDistributionAsync(request, cToken).ConfigureAwait(false);
return update.Distribution.DistributionConfig.ViewerCertificate.ACMCertificateArn == null;
}

Possible Solution

No response

Additional Information/Context

No response

AWS .NET SDK and/or Package version used

AWSSDK.CloudFront 3.7.4.60

Targeted .NET Platform

.net 6.0

Operating System and version

Windows 11

[ashishdhingra]

Using the below minimal .NET 6 code as provided by customer:

// See https://aka.ms/new-console-template for more information
using Amazon.CloudFront;
using Amazon.CloudFront.Model;

string cloudDistributionId = "<<specify your distribution id>>";
AmazonCloudFrontClient amazonCloudFrontClient = new AmazonCloudFrontClient();
var getDistributionRequest = new GetDistributionRequest() { Id = cloudDistributionId };
var dist = amazonCloudFrontClient.GetDistributionAsync(getDistributionRequest).Result;
var viewerCertificate = new ViewerCertificate()
{
    CloudFrontDefaultCertificate = false,
    MinimumProtocolVersion = MinimumProtocolVersion.TLSv1
};

dist.Distribution.DistributionConfig.ViewerCertificate = viewerCertificate;

var request = new UpdateDistributionRequest() { DistributionConfig = dist.Distribution.DistributionConfig, Id = cloudDistributionId, IfMatch = dist.ETag };
var update = amazonCloudFrontClient.UpdateDistributionAsync(request).Result;
Console.WriteLine(update.Distribution.DistributionConfig.ViewerCertificate.ACMCertificateArn == null);

returns the error:

The service returned an error with Error Code InternalError and HTTP Body: <?xml version="1.0"?>
<ErrorResponse xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><Error><Type>Receiver</Type><Code>InternalError</Code></Error><RequestId>70900c6d-d019-42b5-bd72-055b1d009cb8</RequestId></ErrorResponse>

@paulofloresjunior I'm not sure if you are using the correct values. Per your issue, you are trying to set the ViewerCertificate of distribution in CloudFront to None. I created a CloudFront distribution with custom SSL certificate to None, the default Distribution.DistributionConfig.ViewerCertificate setting has CloudFrontDefaultCertificate as true. In your use case, you should be using CloudFrontDefaultCertificate as true, else it means you intend to use SSL certificate and you need to provide other values.

Few references:

• Reverting from a custom SSL/TLS certificate to the default CloudFront certificate, which effectively appears to be the same process of setting the viewer certificate to None.
• ViewerCertificate: If the CloudFrontDefaultCertificate is set as false, then specify values for the fields listed.

Also, instead of retrieving the complete distribution details, you could use GetDistributionConfig to get only the config and then use it to update distribution.

Thanks,
Ashish

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.