how to enable (https) SSL certificate AWS EC2 hosted site - amazon-web-services

So far i did below configuration.
I hosted my site on EC2 AWS machine. Public ip and public DNS.
I can access my website by ip as well as public DNS.
I purchased domain name from GoDaddy. www.xxtrasc.com
On AWS I created Hosted Zone then map www.app.xxtrasc.com successfully.
Now i access my website directly www.app.xxtrasc.com
Next want to enable https
On AWS Certificate Manager order certificate with domain name *.xxtrasc.com
Did everything to add CNAME and all. I can see status gree colored Issued on ACM.
Now how i can attached this certificate to my web site so that i can access https://www.app.xxtrasc.com

You cannot use ACM to directly install your ACM Certificate on your AWS based website or application
https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-install.html
You must use one of the following services:
Elastic Load Balancing
Amazon CloudFront
AWS Elastic Beanstalk
Amazon API Gateway
AWS CloudFormation
Please read the official doc : https://docs.aws.amazon.com/acm/latest/userguide/acm-services.html
So to install the certificate directly under apache2/nginx configuration you need to obtain the certificate from other third parties like Lets Encrypt, GoDaddy etc. you can read about that here - https://in.godaddy.com/help/manually-install-an-ssl-certificate-on-my-apache-server-centos-5238
On AWS I recommend using an ELB an placing your EC2 instances behind this ELB. This will allow you to select your ACM certificate from ELB itslef. Please read following doc to use classic load balancer with HTTPS https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/ssl-server-cert.html

If you want to enable SSL on your site, you need to purchase SSL certificate. You can purchase it with Godaddy and then setup it on AWS server. Without SSL certificate, your https site won't work.

Related

Route53 with SSL Cert

I'm currently using AWS Route 53 for my domain (domain.com), I also generated an wildcard SSL cert from an external certificate authority (*.subdomain.com). I have installed the certificate in ACM.
My domain (domain.com) points to an ELB, which has 2 EC2 instances connected to it (1.1.1.1 and 1.1.1.2).
I want to create a subdomain (sub.domain.com) which points specifically to 1.1.1.2 and also has the SSL cert installed.
I've tried adding an A record in Route 53 with the subdomain pointing to the specific IP (1.1.1.2), this works, but when I add the https protocol it refuses to connect.
I pretty new with SSL and routing so any help is appreciated.
I believe AWS ACM does not support certificate for EC2. it only support for ELB, API Gateway and CloudFront. Please check https://docs.aws.amazon.com/acm/latest/userguide/acm-services.html
So you cannot connect with https on EC2 with certificate imported in AWS. You need to create own certificate manually on EC2.
Below note from AWS for ACM certificate on EC2
Public ACM certificates can be installed on Amazon EC2 instances that are connected to a Nitro Enclave, but not to other Amazon EC2 instances. For information about setting up a stand-alone web server on an Amazon EC2 instance not connected to a Nitro Enclave, see Tutorial: Install a LAMP web server on Amazon Linux 2 or Tutorial: Install a LAMP web server with the Amazon Linux AMI.

How to use amazon certificate to get https on domain route 53

I have an AWS EC2 instance, a Route53 registered domain, an AWS Load Balancer and an AWS Certificate.
What I want to achieve is to access the domain as "https://...", as of today I haven't been able to.
What I've done so far is:
1.- Set the EC2 (Amazon Linux AMI) with apache and it's listening to de ports :80 :443
When I browse to the puclic IP of the EC2 I see index.html no problem.
2.- I have registered a new domain using Route53. I added a Record Set for the Hosted Zone Type IPv4 address with the value of the IP of the EC2 instance.
When I browse to the domain.com I see index.html no problem.
3.- I got an AWS Certificate for *.domain.com and domain.com. For validation I added a Type CNAME Record Set provided to the Hosted Zone of the domain. For both the validation status is OK.
4.- I created a Load Balancer that listens to HTTP:80 and HTTPS:443 and I added a Record Set in the Hosted Zone of the domain with [type:IPv4, Alias:Yes, Alias Target: name of the Load Balancer]. I didn't type the name of the Load Balancer, I selected it from the select dropdown.
However the Load Balancer has the fields Port Configuration and Instance Count blank as you can see in the screenshot.
5.- When I check the file /etc/httpd/logs/ssl_error_log I see a message that I can'f figure out what it means, nothing good I imagine. The text of the message is AH01906: ... as you can see in the next screenshot.
When I browse to https:// domain I get the message that is not safe.
I'm very new to all this and I'm sure I'm doing something wrong but I can't figure out what.
I would appreciate any help or pointer you could give to me.
Thanks very much, this community is awesome anyway.
AWS Certificate Manager does not offer free SSL for website. It does offer free SSL certificate for some of their services endpoint (not the same as using directly on your EC2 instance).
For certificates that you want to install directly on EC2, you have to pay for a private Certificate Authority. (note: its expensive)
Q: With which AWS services can I use ACM certificates?
You can use public and private ACM certificates with the following AWS services:
• Elastic Load Balancing – Refer to the Elastic Load Balancing documentation
• Amazon CloudFront – Refer to the CloudFront documentation
• Amazon API Gateway – Refer to the API Gateway documentation
• AWS Elastic Beanstalk – Refer to the AWS Elastic Beanstalk documentation
• AWS CloudFormation – Support is currently limited to public certificates that use email validation. Refer to the AWS CloudFormation documentation
In addition, you can use private certificates issued with ACM Private CA with EC2 instances, containers, IoT devices, and on your own servers.
Alternatively, you can use Let's Encrypt, a service provided by EFF, for free. They have a tool called CertBot to automatically renew the certificates for you.

AWS Certificate Manager "In use" status "No"

I was imported SSL certificate using AWS Certificate manager and it will display In Use status as No and my Subdomain didn't work with https.
Below image displayed the status as I described. What was the reason for that?
Edit: I used Amazon EC2 with ubuntu box.
The AWS Certificate Manager provides SSL certificates for use in a limted set of AWS services:
From What Is AWS Certificate Manager?
You cannot install an ACM Certificate directly on your website or
application. You must install your certificate by using one of the
services integrated with ACM. For more information about these
services, see Services Integrated with AWS Certificate Manager.
These integrated services are:
Elastic Load Balancing
Amazon CloudFront
AWS Elastic Beanstalk
Amazon API Gateway
It appears you have not configured your ACM SSL to be used in one of these services.
A common misconception is that you can use ACM SSL in any HTTP server on an instance - you cannot. You need to use an ELB infront of any webserver in order to properly configure HTTPS.
You need to go to CloudFront and modify your distribution to point to the new ACM Certificate that you just got. CloudFront will then pick up the new cert and deploy it to your distribution for you. ACM will then mark the certificate as "in use". As long as it's then "in-use", ACM will renew it for you and continue to update CloudFront.

AWS ssl is not working in imported certificate for custom domain

I have dobut in AWS SSL.
I have launched instance in AWS.
Then I got Public IP of launched instance, which pointed to BLUEHOST (only for domain ) DNS record ( Type A).
when I tried subdomain.example.com is working in browser.
Then for SSL, I imported certificate key and crt in certificate manager.And
certificate status is ISSUED.
When I tried HTTPS in browser ( https://subdomain.example.com ) is not working
Any one guide me.
You cannot use the certificate provided by Amazon Certificate Manager(ACM) on EC2 instance. That can only be used with certain AWS services such as Elastic Load Balancer, CloudFront, API Gateway and Elastic Beanstalk.
If you want to use ACM, you can setup a ELB in front of your EC2 instance and have your certificate applied to ELB. When you are requesting for a certificate via ACM make sure to add *.example.com domain to protect your subdomain as well.
If you want to setup SSL on your EC2 instance itself, you can request for SSL certificates from a ssl certificate provider. There are many certificate providers, such as letsencrypt, sslforfree etc..
Here is a guide on how to install SSL certificates obtained from a certificate provider on your EC2 instance.

Connect SSL Cert to Route53 Hosted Domain

For some reason I cannot find a yes or no if this is even possible but I am assuming that it would be. I have a domain through AWS that was purchased through AWS Route53. I also created an SSL Cert through AWS Certificate Manager. Now I'm just trying to add that certificate to the domain. I would think that since it is all interconnected that it would just been applied after I approved it and it finished the setup but alas, it has not. So my question is how/where do I connect my SSL Cert to my Route53 hosted domain?
SSL certificates are not connected to a domain's DNS record (via Route 53).
Instead, they are connected to one or more specific infrastructure components.
SSL certificates that you create from ACM can be used with:
AWS Elastic Load Balancer
AWS CloudFront
Create your infrastructure including one or more of those components and then attach your ACM SSL certificate to that.
See the ACM FAQ: https://aws.amazon.com/certificate-manager/faqs/