I'm deploying django4 on AWS elastic beanstalk(EB), and currently trying to add SSL to the public domain provided by AWS.
Is it actually possible to add SSL to EB's public domain? I know that certbot requires domain name, but does EB's public domain considered good enough?
I tried to use certbot but it failed. Has anybody tried this?
does EB's public domain considered good enough?
Sadly, its not enough, because this domain belongs to AWS, not you. You can only get valid public SSL certificates for domains that you own or at least control. This means, that you can't get SSL cert for EB default domain.
You can add CloudFront in front of your EB and this will give you https endpoint. But all traffic between CloudFront and EB will be http (not https), because again you do not have valid SSL certificate for EB.
Related
Currently, I have a domain(mysite.com) bought in the Google Domain, it's just a domain. My application is hosted on AWS, where I have my application deployed, the setup is quite straightforward - access to the application goes thru ALB(lb-123.com), which has no SSL configured yet. My problem is how to link the domain to ALB throughout HTTPS to my application in AWS which is accessed throughout HTTP. I should be able to access mysite.com using HTTPS and it should access lb-123.com either thru HTTP or HTTPS, but for a client, it should look like it accesses HTTPS.
ALB doesn't have an IP, only DNS - I should use the only CNAME for redirection mysite.com to lb-123.com?
Should I configure HTTTs for ALB too - If so, then what is the right way to do it? What certificate should I use? Is there any free certificate for ALB?
How usually ppl link using HTTPS their domains with any sort of backend which has only DNS name(e.g. AWS ALB)?
The easiest way to get SSL for your ALB is through AWS ACM with provides free SSL certificates:
How can I associate an ACM SSL/TLS certificate with a Classic, Application, or Network Load Balancer?
So in your case, you have to got to AWS ACM, and request a free SSL public SSL cert for your domain. Domain can be at google, it does not matter. Once you verity that you control the domain, you will get a cert issued that you can associate with the ALB.
Then you use CNAME on google to point your domain to ALB's domain.
I have following setup at AWS ECS:
Container with Caddy web-server at 80 port that serves static files and performs proxying of /api/* requests to backend
Container with backend at 8000 port
EC2 instance at ECS
ALB at subdomain http://some-subdomain-12345.us-east-2.elb.amazonaws.com/ (subdomain was provided automatically by AWS) with HTTP Listener
I want to setup SSL certificate and HTTPS Listener for ALB at this subdomain that was provided by AWS - how I can do it?
P.S. I have seen an option for ALB with HTTPS Listener when we are attaching custom domain i.e. example.com and AWS will provide SSL certificate for it. But this is a pet project environment and I don't worry about real domain.
You can put your ALB behind CloudFront, which unlike ALB gives you a TLS certificate by default. So you can address your application at e.g.:
https://d3n6jitgitr0i4.cloudfront.net
Apart from the TLS certificate, it will give you the ability to cache your static resources at CloudFront's edge locations, and improve latency on the TLS handshake roundtrips.
I want to setup SSL certificate and HTTPS Listener for ALB at this subdomain that was provided by AWS - how I can do it?
You can't do this. This is not your domain (AWS owns it) and you can't associate any SSL certificate with it. You have to have your own domain that you control. Once you obtain the domain, you can get free SSL certificate from AWS ACM.
This could be a solution without using subdomains but using path redirection
https://caddy.community/t/caddy-2-reverse-proxy-to-path/9193
I can use Elastic beanstalk with HTTPS, I already created a self-signed certifier and added a listener in the land balancer. .
but when I try to enter the URL I get the following error
Any idea what may be causing this error?
Since you are using ALB, you should get free public SSL certificate from AWS ACM. Then you can easily associate the certificate with your ALB.
This way you don't need to do anything on your instance(s), including no need for self-signed certificates.
I have a CloudFront distribution already configured for an S3 bucket using Route53 domain with HTTPS enabled using a public certificate.
I want to use this CloudFront distribution with another origin (which is an EC2 instance running NGINX as a reverse proxy for an application on that same instance), but I also need to enable HTTPS.
The normal way I would enable HTTPS on EC2 with NGINX is to just setup the nginx configuration and point my domain "A record" to the instance then request a certificate with Let's Encrypt. But how should I do it when behind CloudFront? I won't use Let's Encrypt (not necessarily important to just use it) and would like to use an AWS public certificate as I did with my S3.
Could I just configure NGINX to listen on port 80 and add this EC2 instance as an origin on the CloudFront distribution then enable HTTPS and choose my public certificate there or how should this be done to work properly?
This time I am not going to use a Load Balancer, I want a direct connection between the EC2 and CloudFront. But I would also like to know how to set this up when using a Load Balancer (for the future).
Could I just configure NGINX to listen on port 80 and add this EC2 instance as an origin on the CloudFront distribution then enable HTTPS and choose my public certificate there or how should this be done to work properly?
Yes you can do this, but all traffic pattern will be:
Clinet---(HTTPS)--->CF---(HTTP)--->Instance
Which means that half of your connection (CF->Instance) will be in HTTP, which may not be desired.
If you want to have HTTPs on every path, you still need to have public valid SSL cerfiicate on the instance. CF will not work with self-signed certificates.
I have enabled HTTPS for my custom domain name (haydenclay.page), but I also need the Beanstalk url (app-name.elasticbeanstalk.com) to run through HTTPS as well.
HTTPS does not work currently, because the cert name matches my custom domain name, yielding: ERR_CERT_COMMON_NAME_INVALID
I need HTTPS because I make API requests, and going from HTTPS to HTTP throws a mixed content error. How can I enabled HTTPS on the beanstalk url?
I have already tried making an alias
Sadly you can't enable https directly for app-name.elasticbeanstalk.com domain. This is because this domain is controlled by AWS. You can only register SSL certificates for domains that you control.
If you want to server your content from EB over ssl, you have generally three options.
Front your instance with load balancer. This is the easiest* way as you can associated ACM SSL certificate with the balancer for your domain.
Front your EB instance with CloudFront (CF). You can setup alternative name for your cloudfront domain with your CF distro and your SSL cert. You can also use ACM for that. Also easy setup, but it should be noted that traffic between CF and your EB instance will be http only, unless you also setup your own SSL cert (not from ACM) on the instances (point 3).
Install your own SSL certificate (not from ACM) directly on the EB instance, using nginx. This requires manual setup and a valid public certificate. Popular choice is LetsEncrypt, to get the SSL cert from.
If you use CloudFlare, go to DNS -> Records
Type: CNAME
name: api
Content: "YOUR_URL.eu-west-1.elasticbeanstalk.com"
Proxy status: Proxied
And call your new url: api.your_domain.com