I'm currently working on upgrading my company's application infrastructure.
We started off with having the basic infrastructure - One EC2 instance which is our web server linked to RDS, MySQL database.
The new infrastructure requires a VPC with 2 Public Subnets with EC2 instances and 2 Private subnets for the DB.
So, here's what I did, I created an image from the existing EC2 instance which has SSL certificate installed in it and it matches with the domain name.
From that image, I launched 2 new AMI and added a load balancer. Now the whole infra has been set up but here's the issue now - after pointing the load balancer's DNS to to the mobile app (via API), there's an error that's coming up,
javax.net.ssl.SSLException: hostname in certificate didn't match: != OR OR
03-10 13:41:23.641 29743-30234/example.hr W/System.err: at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:190)
03-10 13:41:23.641 29743-30234/example.hr W/System.err: at org.apache.http.conn.ssl.BrowserCompatHostnameVerifier.verify(BrowserCompatHostnameVerifier.java:59)
From what I understand is that I'll have to add the load balancer DNS to the root domain (can be done but we cant put down the existing server). Will that work? I can do it but it will take a while for the domain service provider to add it as a CNAME record (Since it is a .hr domain, it's controlled and some records can't be added easily. It will take more than a day for it to be done)
Secondly, if I were to add an SSL cert on the load balancer's level, will it create conflicts with the SSL cert on instance level?
I'm also looking at getting a new domain and to configure on an instance level, will be a nuisance. Is there an alternative to this?
Terminating secure connections at the load balancer and using HTTP on the backend may be sufficient for your application. However, if you are developing an application that needs to comply with strict external regulations(EX: HIPPA Cert), you may be required to secure all network connections.
ELB does SSL Offloading/Termination. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the instances and then the instance can use the self-signed certificates.
Ref:
Elastic Load Balancer SSL Support Options
Classic ELB HTTPS Listeners
Related
This is my first time playing around with web development. I'm trying to deploy a simple dockerized Flask application to my domain (example.com).
First, I've deployed the Flask application listening on port 80 of my EC2 instance. All it does is render a frontend on the index path ('/').
I've connected the Cloudfront to https://example.com with a certificate created through ACM.
Next, I created an application load balancer (ALB) on top of the EC2 instance, by adding a listener on port 443 and forwarding traffic to a target group on the EC2 instance instance and port 80.
Within the Cloudfront settings, I have set my the origin as my load balancer through the AWS Cloudfront "add custom origin" settings.
However, once I navigate to either the Cloudfront URL or https://www.example.com, I run into a 502 error.
I've tried several steps to debug including checking the security group of the application load balancer and invalidating Cloudfront cache. I'm also able to view the http:// version of my EC2 instance just fine so I think it is something with the connection between cloudfront and the load balancer. After Googling around, my thought was that this particular 502 error might be an issue with the certificate of the load balancer, since I'm using that same certificate for the cloudfront.
I tried to follow steps to add my load balancer URL (ending in .com) to ACM but got that my certificate status was failed. I was wondering: is this what is going on and how can I issue a free valid certificate for my application load balancer using ACM? There are many sources that say this is possible, but I haven't been able to figure it out. Thanks!
Background of the Application
I have MERN Stack Application running (where frontend reactJS is running inside NodeJS backend server)
The whole application is then wrapped inside Docker Container
Then Deployed in AWS ECS EC2 (using single Service & Task) behind a single Application Load Balancer.
Created a Hosted Zone in AWS Route 53 to Point my domain name to Load Balancer
Now the application is successfully running when I visit my domain name.
Problem Araised Here
The website is "Not Secure"!! — I want to install SSL Certificate
I went to AWS Certificate Manager
Successfully got a certificate by adding CNAME in the AWS Hosted Zone Records
Configured Security Group, Load balancer Listeners to HTTPS
Added that Certificate to Load Balancer listener
Actual Problem
I got the certificate, connected to load balancer,
I can see my certificate in the address bar - "Certificate is Valid"
And still, it shows my the Site is "Not Secure" - Below image is for your reference.
Error in the Console (Edited)
Mixed Content: The page at 'https://example.com/' was loaded over HTTPS, but requested an insecure resource 'http://my-alb-XXXXXXX.us-xxxx-X.elb.amazonaws.com/api/goals'. This request has been blocked; the content must be served over HTTPS.
My Assumption of What Went Wrong
Since AWS ALB has its own DNS Name, which is "Not Secure"
Connecting my new secured domain name TO an unsecured AWS ALB DNS name would be the problem.
Appreciate Your Response
Thank you,
ARUN
We have an internal facing application load balancer in AWS VPC. This is being accessed by a web app running in a public subnet. The web app is behind a custom domain url and it uses SSL certificate for security.Since, the API load balancer is not applied with SSL, communication from web app to API LB is failing.
Is it possible to get a SSL certificate for an internal facing load balancer in AWS?
Yes this is entirely possible using the AWS ACM service, there are two options, you can use Amazon's public service to generate certs but I assume that is not what you want to do here. So you can alternatively create a Private CA through this service and distribute your certificates from there which can then be placed on Loadbalancers etc. You will most likely want to look at these pages:
https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html
https://aws.amazon.com/certificate-manager/
Have a read first before diving right in but it's a pretty nifty feature for this sort of thing, once the CA is setup then creating certs is so fast and instantly attachable to resources.
Recently, I started searching about security procedures and came across SSL. Actually, I already knew about SSL, but I found to be too expensive at the time.
Luckily, yesterday I found out that Amazon gives SSL certificates for free!
However, I have spent a whole day trying to set it up but it didn't work.
I have a domain registered at GoDaddy, let's assume its www.mydomain.com. My website is hosted, however, on Amazon Web Services (AWS). I also have access to edit the GoDaddy's DNS records and full access to my AWS account. I have seen LetsEncrypt, but my website runs in ASP.NET (IIS Windows) and currently they only support Linux OS.
Here's what I've tried to do:
Get a SSL Certificate from AWS Certificate Manager
I have chosen to setup via DNS, which means I had to add a CNAME record to GoDaddy domain records.
If you look above carefully on the two images, the CNAME record on AWS is on the center of the page. I've added a record as CNAME containing the values.
Add HTTPS to Load Balancer Listeners:
Allowed HTTPS on Security Groups
NOTE: Both Inbound and Outbund rules are just like above. I have also set the Load Balancer and my Running Instance to use this security group.
Added records to Route 53 Hosted Zones
The A type record points to my instance IP.
The NS record was generated by Amazon (I added GoDaddy's Name servers as well).
The SOA record was generated by Amazon and I didnt touch it.
The CNAME was added by me, It's again the SSL protocol.
I don't know what else to do or if I have a wrong setup.
If I'm not mistaken, you have an EC2 instance behind an ELB (Classic/Application/NLB), requested an ACM certificate which has been issued successfully for *.mydomain.com, created HTTPS listener to use the SSL certificate but getting connection time out on port 443.
The issue is the DNS record of mydomain.com still points to the EC2 instance's IP, which might not be listening on port 443 (and the ELB is not being used at all).
So, to resolve this, you have to use the ELB's DNS name and use it as CNAME in your DNS record (not sure whether in Route 53 or GoDaddy because I don't know which is authoritative NS).
Also, you might consider requesting a new certificate with mydomain.com and *.mydomain.com and update the listener because ACM cert with *.mydomain.com does not protect mydomain.com.
I am attempting to add HTTPS to my AWS Elastic Load Balancer.
I obtained a certificate through AWS Certificate Manager:
I have enabled HTTPS on the load balancer:
I made sure the security group for the load balancer accepts 0.0.0.0/0 on 443:
When going to my domain on HTTP, it works.
However, when trying to load my domain with HTTPS, it does not work ("ERR_CONNECTION_TIMED_OUT")
EDIT and UPDATE:
It is the API that I am attempting to get HTTPS working for, not necessarily the domain. The domain serve's a static file (angular web app) from S3, and it is angular that is calling the load balancer (to transfer the request to an EC2 instance) for DB data.
When angular calls the api directly via the load balancer domain name over HTTP, the request responds as expected.
When angular makes the same api call over HTTPS, I get the following error:
You enabled HTTPS for your domain name, not the ELB domain which Amazon owns. You can only create SSL certificates for domains that you own. You can't enable SSL for "mydomain.com" and then excpect that to somehow work on a completely different domain. You need to change your AngularJS code to reference the API by your custom domain name which you have created an SSL certificate for. You need to point the domain to the ELB and install the SSL certificate for the domain on the ELB.
Mark B provided the almost full solution.
As my javascript code is calling the elastic load balancer (ELB) via it's DNS name provided by AWS, I can't obtain an SSL certificate for the domain I don't own.
As Mark B pointed out, I need to point my javascript code to the domain I do own, and have an SSL cert for.
So I can create a sub domain (e.g. api.mydomain.com) of the domain I own that then points to the ELB.
An A Record (e.g domain pointing to an IP) looks like it could fit the need.
However, an A Record can't point to the ELB because it's IP could change.
The missing step was to use AWS Route 53 to point the A Record to an alias (Route 53 allows you to do this) that represented my AWS Elastic Load Balancer.