自动化电子邮件验证 - AWS Certification

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

自动化电子邮件验证

通过电子邮件验证的ACM证书通常需要域名所有者手动操作。处理大量经电子邮件验证证书的企业可能更愿意创建一个可以自动执行所需响应的解析器。为了帮助客户使用电子邮件验证,本节中的信息介绍了用于域验证电子邮件的模板以及完成验证过程所涉及的工作流。

验证电子邮件模板

验证电子邮件具有以下两种格式之一,具体取决于是申请新证书还是续订现有证书。突出显示的字符串的内容应替换为特定于正在验证的域的值。

验证新证书

电子邮件模板文本:

Greetings from Amazon Web Services, We received a request to issue an SSL/TLS certificate for requested_domain. Verify that the following domain, AWS account ID, and certificate identifier correspond to a request from you or someone in your organization. Domain: fqdn AWS account ID: account_id AWS Region name: region_name Certificate Identifier: certificate_identifier To approve this request, go to Amazon Certificate Approvals (https://region_name.acm-certificates.amazon.com/approvals?code=validation_code&context=validation_context) and follow the instructions on the page. This email is intended solely for authorized individuals for fqdn. To express any concerns about this email or if this email has reached you in error, forward it along with a brief explanation of your concern to validation-questions@amazon.com. Sincerely, Amazon Web Services

验证证书以进行续订

电子邮件模板文本:

Greetings from Amazon Web Services, We received a request to issue an SSL/TLS certificate for requested_domain. This email is a request to validate ownership of the domain in order to renew the existing, currently in use, certificate. Certificates have defined validity periods and email validated certificates, like this one, require you to re-validate for the certificate to renew. Verify that the following domain, AWS account ID, and certificate identifier correspond to a request from you or someone in your organization. Domain: fqdn AWS account ID: account_id AWS Region name: region_name Certificate Identifier: certificate_identifier To approve this request, go to Amazon Certificate Approvals at https://region_name.acm-certificates.amazon.com/approvals?code=$validation_code&context=$validation_context and follow the instructions on the page. This email is intended solely for authorized individuals for fqdn. You can see more about how AWS Certificate Manager validation works here - https://docs.aws.amazon.com/acm/latest/userguide/email-validation.html. To express any concerns about this email or if this email has reached you in error, forward it along with a brief explanation of your concern to validation-questions@amazon.com. Sincerely, Amazon Web Services -- Amazon Web Services, Inc. is a subsidiary of Amazon.com, Inc. Amazon.com is a registered trademark of Amazon.com, Inc. This message produced and distributed by Amazon Web Services, Inc., 410 Terry Ave. North, Seattle, WA 98109-5210. (c)2015-2022, Amazon Web Services, Inc. or its affiliates. All rights reserved. Our privacy policy is posted at https://aws.amazon.com/privacy

收到来自的新验证消息后 AWS,我们建议您将其用作解析器的最 up-to-date 权威的模板。使用 2020 年 11 月之前设计的消息解析器的客户应注意,可能已对模板进行如下更改:

  • 电子邮件主题行现在显示为“Certificate request for domain name”而不是“"Certificate approval for domain name”。

  • 现在,AWS account ID 在显示时不带破折号或连字符。 

  • 例如,Certificate Identifier现在显示的是整个证书,ARN而不是缩短的表格,arn:aws:acm:us-east-1:000000000000:certificate/3b4d78e1-0882-4f51-954a-298ee44ff369而不是3b4d78e1-0882-4f51-954a-298ee44ff369

  • 证书批准URL现在包含acm-certificates.amazon.com而不是certificates.amazon.com

  • 点击证书批准打开的批准表单URL现在包含批准按钮。批准按钮 div 的名称现在是 approve-button 而不是 approval_button

  • 新请求的证书和续订证书的验证消息具有相同的电子邮件格式。

验证工作流程

本节提供有关经电子邮件验证的证书的续订工作流程相关信息。

  • 当ACM控制台处理多域证书请求时,它会向您在申请公共证书时指定的域名或验证域发送验证电子邮件。域名所有者需要先验证每个域的电子邮件,然后ACM才能颁发证书。有关更多信息,请参阅使用电子邮件验证域所有权

  • 使用ACMAPI或CLI对多域证书请求进行电子邮件验证后,每个请求的域都会发送一封电子邮件,即使请求中包含其他域的子域名也是如此。域名所有者需要先验证每个域名的电子邮件,然后ACM才能颁发证书。

    如果您通过ACM控制台重新发送现有证书的电子邮件,则电子邮件将发送到原始证书请求中指定的验证域,如果未指定验证域,则发送到确切的域名。要在其他域名接收验证电子邮件,您可以申请新证书,指定要用于验证的验证域。或者,您可以ResendValidationEmail使用APISDK、或使用ValidationDomain参数调用CLI。但是,ResendValidationEmail请求中指定的验证域仅用于该调用,不会保存到证书 Amazon Resource Name (ARN) 中以备将来的验证电子邮件使用。ResendValidationEmail每次您希望通过原始证书申请中未指定的域名收到验证电子邮件时,都必须致电。

    注意

    在 2020 年 11 月之前,客户只需验证 apex 域名,并且ACM将颁发涵盖所有子域名的证书。使用此时间之前设计的消息解析器的客户应注意电子邮件验证工作流程的更改。

  • 使用ACMAPI或CLI,您可以强制将多域证书请求的所有验证电子邮件发送到 apex 域。在中API,使用RequestCertificate操作的DomainValidationOptions参数为其指定一个值ValidationDomain,该值是该DomainValidationOption类型的成员。在中CLI,使用 request-certificati on 命令的--domain-validation-options参数为指定值。ValidationDomain