To have AWS create an X.509 certificate for you
1.
Go to the Amazon Web Services web site at
http://aws.amazon.com
.
2.
Point to Your Web Services Account to display a list of options.
3.
Click View Access Key Identifiers and log in to your AWS account.
The AWS Access Key Identifiers page is displayed.
4.
Scroll down to the X.509 Certificate area of the page and click Create New.
The Create a New Certificate page is displayed.
5.
Read the information on the page and click Yes to create your certificate.
The Create Success page is displayed.
6.
Download your private key file and X.509 certificate file.
Important
Don't close the browser window before you download the certificate, otherwise you'll have
to create a new certificate.
What Needs to Be Signed
Each SOAP request must be signed with the private key associated with the X.509 certificate. To create
the signature, you sign the
Timestamp
element, and if you're using WS-Addressing, we recommend you
also sign the
Action
header element. In addition, you can optionally sign the
Body
and the
To
header
element.
Example Request to Use When Troubleshooting
The following example shows the initial portion of a SOAP request that uses WS-Security with an X.509
certificate. If you're using a SOAP toolkit that supports WS-Security and X.509 certificates, the toolkit
constructs the request automatically for you, so you don't have to create a request like this yourself. The
example is included here as a reference to use if you're troubleshooting authentication issues with your
SOAP requests. Several requirements are listed following the example; the numbers highlight where in
the example the requirements are satisfied.
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-
wss-wssecurity-secext-1.0.xsd">
<wsse:BinarySecurityToken
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecur
ity-utility-1.0.xsd"
EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-
soap-message-security-1.0#Base64Binary"
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-
x509-token-profile-1.0#X509v3"
wsu:Id="CertId-1064304">
[Your base64 encoded X.509 certificate…]
</wsse:BinarySecurityToken>
API Version 2011-08-01
68
Product Advertising API Developer Guide
Request Authentication
