Background of the Application
I have MERN Stack Application running (where frontend reactJS is running inside NodeJS backend server)
The whole application is then wrapped inside Docker Container
Then Deployed in AWS ECS EC2 (using single Service & Task) behind a single Application Load Balancer.
Created a Hosted Zone in AWS Route 53 to Point my domain name to Load Balancer
Now the application is successfully running when I visit my domain name.
Problem Araised Here
The website is "Not Secure"!! — I want to install SSL Certificate
I went to AWS Certificate Manager
Successfully got a certificate by adding CNAME in the AWS Hosted Zone Records
Configured Security Group, Load balancer Listeners to HTTPS
Added that Certificate to Load Balancer listener
Actual Problem
I got the certificate, connected to load balancer,
I can see my certificate in the address bar - "Certificate is Valid"
And still, it shows my the Site is "Not Secure" - Below image is for your reference.
Error in the Console (Edited)
Mixed Content: The page at 'https://example.com/' was loaded over HTTPS, but requested an insecure resource 'http://my-alb-XXXXXXX.us-xxxx-X.elb.amazonaws.com/api/goals'. This request has been blocked; the content must be served over HTTPS.
My Assumption of What Went Wrong
Since AWS ALB has its own DNS Name, which is "Not Secure"
Connecting my new secured domain name TO an unsecured AWS ALB DNS name would be the problem.
Appreciate Your Response
Thank you,
ARUN
Related
This is my first time playing around with web development. I'm trying to deploy a simple dockerized Flask application to my domain (example.com).
First, I've deployed the Flask application listening on port 80 of my EC2 instance. All it does is render a frontend on the index path ('/').
I've connected the Cloudfront to https://example.com with a certificate created through ACM.
Next, I created an application load balancer (ALB) on top of the EC2 instance, by adding a listener on port 443 and forwarding traffic to a target group on the EC2 instance instance and port 80.
Within the Cloudfront settings, I have set my the origin as my load balancer through the AWS Cloudfront "add custom origin" settings.
However, once I navigate to either the Cloudfront URL or https://www.example.com, I run into a 502 error.
I've tried several steps to debug including checking the security group of the application load balancer and invalidating Cloudfront cache. I'm also able to view the http:// version of my EC2 instance just fine so I think it is something with the connection between cloudfront and the load balancer. After Googling around, my thought was that this particular 502 error might be an issue with the certificate of the load balancer, since I'm using that same certificate for the cloudfront.
I tried to follow steps to add my load balancer URL (ending in .com) to ACM but got that my certificate status was failed. I was wondering: is this what is going on and how can I issue a free valid certificate for my application load balancer using ACM? There are many sources that say this is possible, but I haven't been able to figure it out. Thanks!
I have an application running on an AWS EC2 instance, port 8501. I cannot change the port for multiple reasons. I set up a reverse proxy with nginx using this YT tutorial to redirect http://[domain].com to port 8501.
That works fine.
I obtained an SSL certificate from AWS Certificate Manager and have since learned that AWS certificates only work with certain AWS services, here, here, and here. However, none of those StackOverflow links--or the AWS instruction pages linked therein--actually described how to connect the https request to the Application Load Balancer to the EC2 instance as set forth by my nginx reverse proxy above.
That is, I've more or less followed this YT tutorial to set up a load balancer and attach the SSL certificate obtained from AWS Certificate Manager, but when I type https://[domain].com, I receive a "site can't be reached" error. http://[domain].com still works.
I've tried both HTTP:80 and HTTPS:443 for the Protocol:Port in my Target Group required by AWS Load Balancer. What more do I need to do?
EDIT: added images with ALB settings, etc:
load balancer listeners
target group overview
nginx config settings
I followed the following tutorial to setup an SSL Certificate with a parent domain hosted at another provider than aws to create a secure connection to my REST Api.
https://medium.com/#sonalishah_63223/how-to-host-subdomain-in-aws-route-53-for-an-existing-parent-domain-with-different-service-9b4dde061b85
Setup:
Hosted Zone -> Record pointing to - Elastic Load Balancer - Beanstalk -> EC2 (Spring Application)
Setup Description:
I created a hosted zone (sub.mydomain.at).
In that hosted zone I created a record (api.sub.mydomain.at) pointing to the Elastic Load Balancer.
Everything works fine, API is callable.
Afterwards I created a certificate through ACM.
(*.mydomain.at) which has been successfully issued.
I attached it to my load balancer and it seems to work, when calling the API via https://.
But Postman throws the following error.
SSL Error: Hostname/IP does not match certificate's altnames
I could turn off "Enable SSL certificate verification" and it would work, but this does not seem to be the right solution.
So I created another Certificate for the domain api.sub.mydomain.at which is not verifying. According to nslookup the server can't find the domain even if the CNAME is setup. (I assume it is not possible to create a CNAME with multiple 'sub-domains')
_12312<long-_number>.api.sub.mydomain.at
So how can I resolve the Issue "Hostname/IP does not match certificates alt names"?
I think in your case, you are forwarding the requests (cname record api.sub.mydomain.at from alb public dns to your custom domain)
So you need to add ALB public dns name on hearder like this:
request({host: 'ALB public DNS'... headers: req.headers
I am trying to implement SSL certificate on my EC2 instance which is running a laravel project. I have issued the certificate and it is also in use but when I try https://domainName my browser shows
Unable to connect
I have used:
EC2
Route53
Certificate Manager
Load Balancer
Elastic Beanstalk
This is exactly how I configured my Load Balancer, Then added my DNS Name to Route53.
I didn't know what details should I provide so please do ask for the information.
Check the web service if it is working correctly locally in you ec2 and listen on port 8o, then apply ssl offloading with application load balancer: please check the following example: https://infra.engineer/aws/36-aws-ssl-offloading-with-an-application-load-balancer
I am trying to setup HTTPS across my app which consists in a frontend (S3 bucket distributed with CloudFront), and a backend (node.js app inside Elastic Beanstalk).
For the CloudFront part, I created an SSL certificate in N. Virginia (apparently I don't have a choice here) and I made the binding in the CloudFront distribution. It works and my app is served over HTTPS.
For the Elastic Beanstalk part, I created an SSL certificate in Ireland (where my EBS app is hosted) and I bound this certificate to the EBS load balancer using the port 443. It works and I can reach my server with HTTPS using Postman.
However, when my frontend tries to make an API call to the backend I get this error :
I guess I made a mistake while creating the certificates, but I cannot find it. I gave both certificates the same set of CNAMES, I am not sure if I am supposed to do that.
EDIT :
I get the exact same error after updating the frontend so that it points the DName of the load balancer (also mapped to subdomain with Route 53).
CloudFront is attempting to load an HTTPS URL from your load balancer. I assume you have an SSL certification assigned to the load balancer. The domain name of the SSL certificate on the load balancer needs to match the domain name that CloudFront is requesting.
For example if the load balancer's SSL certificate is something like beanstalk.mydomain.com then CloudFront would need to be making requests for https://beanstalk.mydomain.com. The error CloudFront is giving you says that the domain name of the SSL certificate served by the load balancer does not match the domain name djumbo-back-debug.eu-west-1.elasticbeanstalk.co.
You need to setup something like the following:
DNS Name www.mydomain.com points to CloudFront Distribution
Configured to serve www.mydomain.com
Configured with an SSL certificate for the domain www.mydomain.com
Configure to pull from the origin beanstalk.mydomain.com
DNS Name beanstalk.mydomain.com points to Elastic Beanstalk application
With a Load Balancer, with an SSL certificate for beanstalk.mydomain.com