(elasticloadbalancingv2): adding a new certificate to a multi-certificate listener will lose old extra ceritifactes

[akefirad]

If you try to add a new certificate to a listener that has already at least one extra certificate (i.e. one in addition to the main certificate), the old extract certificate will be lost by the end of update operation.

Reproduction Steps

(In my case, it happened like this:)

1. Create an HTTPS listener with two certificates; foo.com (main one) and bar.com (additional one) stack and deploy it.
2. Change the code and add a new certificate; baz.com to the list and deploy it.

What did you expect to happen?

The listener should keep one main certificate and two extra certificates.

What actually happened?

The old extra certificate (bar.com) is gone.

Environment

• CLI Version : 1.89.0
• Framework Version: 1.89.0 (build df7253c)
• Node.js Version: v15.5.1
• OS : Mac OS X 11.2
• Language (Version): typescript ~3.8.2

Other

Please note that, according to my findings from AWS support, this seems to be a bug/feature of CloudFormation. Interestingly, even though the Certificates field is of type Array, the documentation says: You can specify one certificate per resource.
If my understanding is correct, CDK should not put all additional certificates into one AWS::ElasticLoadBalancingV2::ListenerCertificate resource. It should be one AWS::ElasticLoadBalancingV2::ListenerCertificate resource per each additional certificate.

---

This is 🐛 Bug Report

[njlynch]

Thanks for the bug report -- and for including the response from support!

I suspect the answer is to alter the below code block:

aws-cdk/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener.ts

Lines 266 to 271 in 9663093

	if (additionalCerts.length > 0) {
	new ApplicationListenerCertificate(this, id, {
	listener: this,
	certificates: additionalCerts,
	});
	}

Rather than creating one ApplicationListenerCertificate for the remainder certificates, it appears one ApplicationListenerCertificate needs to be created per certificate.

This should be a relatively straightforward change; PRs welcome if anyone has the time to go after it!

[andreialecu]

@njlynch: I just made an attempt at this in #13332

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.