I am trying to make my elb backend route protected by https. I have a lot of images below showing where I'm at. As far as AWS instruction, I have everthing from the CNAME done to security groups. However, when I call the route I get 'Error: SSL peer certificate or SSH remote key was not OK'. I'm working with an apache proxy server. What am I missing thanks!
Below image is the listeners on ELB.
Here are the listeners from EC2.
Here is my certificate.
Here is my security group.
Here are my inbound rules
Related
Currently getting the net::ERR_CERT_COMMON_NAME_INVALID when trying to access my application through the ALB.
This is my current setup:
SSL Certificate created that covers example.com & *.example.com using AWS Certificate Manager.
2 server ec2 instances behind a load balancer and 2 client instances behind another load balancer.
An alias record in my Route 53 hosted zone pointing to the client ALB.
Both ALBs have the SSL certificate for example.com attached to them.
Both ALBs have a single HTTPS: 443 listener forwarding https traffic to ec2 instances on port 80.
The server ALB security group allows inbound traffic from the client ALB Security Group and outbound to the server instances security group.
The applications in the client ec2 instances are React Apps pointing to the server ALB at https://xxxxxxxxxx.elb.amazonaws.com/api
Accessing the application via https://example.com causes net::ERR_CERT_COMMON_NAME_INVALID in the console with the browser saying:
Error: The certificate for this server is invalid. You might be connecting to a server that is pretending to be “xxxxxxxxxx.elb.amazonaws.com” which could put your confidential information at risk.
I'd be happy to provide more details if it helps.
If you have your own domain example.com with correct SSL certificate then you can't use https://xxxxxxxxxx.elb.amazonaws.com/api which is AWS domain. The reason is that SSL cert is for example.com, not for https://xxxxxxxxxx.elb.amazonaws.com/api.
You have to modify your application code to only use example.com.
I have an EC2 Ubuntu Instance running on AWS.
I have created a SSL certificate for my domain using AWS Certificate Manager.
i have created the needed hosted zone with the needed records for my domain.
I have created a Load Balancer with listeners for both protocols HTTP and HTTPS.
Now, I can access the site using the public IP from the AWS Instance and also using my domain name.
The issue is when trying to access the site using https.
There appears an error page: ERR_SSL_PROTOCOL_ERROR
I don't know what is wrong in my approach to get a working site running with a SSL certificate.
I guess it can be due to the Ubuntu Apache2 configuration, but not sure.
I would appreciate a checklist of things I should verify in AWS (Certificate Manager, EC2 Instance, Load Balancer, Route 53, etc.) or in the configuration of the Ubuntu Apache2 server.
EDIT:
This is the security group inbound rules that are in use with the ELB
I would double check security group on the ELB, confirm domain DNS. It's something on the ELB side since you are not connecting there.
I have configured the AWS load balancer to secure my website, i.e. to resolve through "https". But when I use(https://www.schoolnskill.com), it gives
503 Service Temporarily Unavailable.
So I have followed the below steps to configure my environment.
I created a domain name in route53 and have been issued with a SSL/TLS certificate through AWS Certificate manager.
For my load balancer I set up listener for https:443 and attached the above certificate with it.
The security group for my ec2 instances allow http and https requests (although I believe the load balancer ec2 target will communicate using http).
I have attached a screenshot with the summary of the configuration.
Then in the ROUTE 53, I edited the 'A' record of 'www.schoolnskill.com'. Below are the changes I made.
Alias:- yes
Alias target:- chosen the application LB
Routing policy:- simple
Then save the settings.
I can see that whenever I type 'http://www.schoolnskill.com', it is redirected as 'https://www.schoolnskill.com'
Health_CHK
Thank you,
The problem was the availability zones. The AZ of my load balancer was different from that of EC2 instance. I matched the AZ of ALB to my EC2, and it worked.
Thank you,
I have an ec2 instance behind Application ELB in AWS. I want to apply SSL to both ec2 instance as well as loadbalancer. For ec2 instance i have purchased ssl and installed it and it is working fine. For load balancer i will be using the free AWS ACM certificate and installing it on load balancer. Will this have any issues? i.e. installing SSL on both places ec2 and elb.
It will not have any issues but it does come with a caveat. The traffic in to the Application Load Balancer (ALB) will be encrypted and the ACM cert will be validated by the client. The traffic to the host from the ALB will also be encrypted but the certificate on the host will not be validated.
It looks like ALB Backend Authentication is on AWS's roadmap per the reference below. The reason given for it not being a priority is summarized in this quote from the AWS Engineer who wrote the first reference:
The role that server certificates play in TLS is to authenticate the server, so that it can’t be impersonated or MITM. ALBs run exclusively on our Amazon VPC network, a Software Defined Network where we encapsulate and authenticate traffic at the packet level.
The upside of this is you can use self-signed certs on your hosts to save money when using an ALB or ELB in front of them.
If you need to ensure the certificate on the host is valid you can use a Classic Elastic Load Balancer (ELB). See the reference for more details.
References
AWS ALB Validation TLS Reply
AWS ELB Configure Backend Authentication
If you use SSl/TSL at ELB, it will handle the encryption/decryption of the HTTPS connections (freeing your EC2 instance's CPU to do other work).
If you use an HTTPS/SSL connection for your back end, you can enable authentication on the back-end instance. This authentication can be used to ensure that back-end instances accept only encrypted communication, and to ensure that the back-end instance has the correct certificates.
Using SSL/TLS on both ELB and Backend can create problems since ELB HTTPS listener does not support Client-Side SSL certificates.
I have considered that you are using a 2-way SSL (Mutual or Client Authentication)
I am working with AWS-API-Gateway and an Elastic Beanstalk environment. What I want to make sure in the Elastic Beanstalk environment is that the request is served only for AWS-API-Gateway.
So Amazon suggested for client-side SSL certificate authentication. The problem I'm facing in this is that even if I configure Amazon API gateway to provide a certificate on a https connection, it will give the certificate to the load-balancer and load-balancer will give its certificate to my ec-2 instance.
So in this scenario, I never receive the SSL certificate of API gateway. Please help me here or provide me with a better solution.
I don't want to remove my load-balancer in the scenario as it is helpful for me.
As far as I know, the key with using ELB is to turn the ELB to TCP mode (not HTTP) so the SSL handshake is actually done on the EC2 instances. That way you can verify on the hosts and treat the ELB as just a simple TCP load balancer.
Some helpful info here Support for two-way TLS/HTTPS with ELB