I am spinning a new EC2 instance on demand using AMI by script using Java SDK from here at http://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/welcome.html
I am hosting rest API's on the newly spun EC2 instance from AMI on port 8000. I want to access instance from IP only as I will spinning many instances from base AMI when needed and will be destroying when not needed.
I want to call this API's from another web application which is hosted under HTTPS. I know it will not allow me to hit HTTP from HTTPS due to Mixed Content.
After some research, I found AWS provides ACM-Server Certificates service which can be applied to EC2. Ref http://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/examples-iam-server-certificates.html
But it works with services integrated with ACM as per document saying at below link
http://docs.aws.amazon.com/acm/latest/userguide/acm-services.html >>
You cannot install an ACM Certificate directly on your website or
application. You must install your certificate by using one of the
services integrated with ACM. For more information about these
services, see Services Integrated with AWS Certificate Manager.
Elastic Load Balancing
Amazon CloudFront
AWS Elastic Beanstalk
Amazon API Gateway AWS
CloudFormation
But I am not using any of above-mentioned services. Is there any way to achieve this and install SSSL on EC2 ip using script ?
This is a common question, because AWS ACS certificates are free.
Thus, to avoid using such certificates with other services than AWS ones, AWS never discloses the associated private keys to its customers.
To let the https server on your EC2 instance use such a certificate, AWS should give you the private key, for you to configure the https server itself.
This is why you can not use an ACS certificate with your EC2 instance. You need to configure an Elastic Load Balancing instance in front of it, so that AWS provides this ELB with your certificate and private key (or provide an HSM with this private key and connect this HSM to the ELB front-end).
Note that using an ELB instance in front of your EC2 instance, in order to be able to use a free certificate from the AWS ACS service, is probably a bad idea: certificates are often cheaper (depending on their type and duration, of course) than the ELB cost overhead.
Note that Let'sEncrypt (https://letsencrypt.org/) can provide your EC2 instance with free DV (domain validated) certificates. You just need to install the Certbot ACME client, since you have shell access to your EC2 instance.
Related
I have purchased a domain from godaddy provider and I launched an application with AWS route 53 service.
My questions:
Where to get a SSL certificate? GoDaddy or AWS
How to setup SSL certificate?
Please tell me
This depends upon your use case or where are you running your application like ECS or EC2 or some static website over s3?
If you are using load balancer on the top of your application then the certificate from AWS is best. you don't need to worry about renewal etc and any other configuration just create load balancer with AWS Certificate Manager.
https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-create-https-ssl-load-balancer.html
CloudFront:
Here is the link how you can configure with CloudFront.
If you to configure directly on your EC2 instance then it's not possible.
Although you install your website on an Amazon EC2 instance, you
cannot directly deploy an ACM Certificate on that instance source AWS Doc
Here is the list on which you can AWS certificate.
Elastic Load Balancing
Amazon CloudFront
AWS Elastic Beanstalk
Amazon API Gateway
AWS CloudFormation
Services Integrated with AWS Certificate Manager
You mention that you launched application with Route53 so want to clear one thing
Amazon Route 53 is a highly available and scalable cloud Domain Name
System (DNS) web service.
So Route 53 in DNS and it can be configured with
Amazon Route 53 effectively connects user requests to infrastructure
running in AWS – such as Amazon EC2 instances, Elastic Load Balancing
load balancers, or Amazon S3 buckets – and can also be used to route
users to infrastructure outside of AWS.
Amazon Route 53
As we are using AWS certificate and we feel good with AWS services, far better than any other service provider in our case.
Let me know if you need further details.
I have an AWS EC2 instance, a Route53 registered domain, an AWS Load Balancer and an AWS Certificate.
What I want to achieve is to access the domain as "https://...", as of today I haven't been able to.
What I've done so far is:
1.- Set the EC2 (Amazon Linux AMI) with apache and it's listening to de ports :80 :443
When I browse to the puclic IP of the EC2 I see index.html no problem.
2.- I have registered a new domain using Route53. I added a Record Set for the Hosted Zone Type IPv4 address with the value of the IP of the EC2 instance.
When I browse to the domain.com I see index.html no problem.
3.- I got an AWS Certificate for *.domain.com and domain.com. For validation I added a Type CNAME Record Set provided to the Hosted Zone of the domain. For both the validation status is OK.
4.- I created a Load Balancer that listens to HTTP:80 and HTTPS:443 and I added a Record Set in the Hosted Zone of the domain with [type:IPv4, Alias:Yes, Alias Target: name of the Load Balancer]. I didn't type the name of the Load Balancer, I selected it from the select dropdown.
However the Load Balancer has the fields Port Configuration and Instance Count blank as you can see in the screenshot.
5.- When I check the file /etc/httpd/logs/ssl_error_log I see a message that I can'f figure out what it means, nothing good I imagine. The text of the message is AH01906: ... as you can see in the next screenshot.
When I browse to https:// domain I get the message that is not safe.
I'm very new to all this and I'm sure I'm doing something wrong but I can't figure out what.
I would appreciate any help or pointer you could give to me.
Thanks very much, this community is awesome anyway.
AWS Certificate Manager does not offer free SSL for website. It does offer free SSL certificate for some of their services endpoint (not the same as using directly on your EC2 instance).
For certificates that you want to install directly on EC2, you have to pay for a private Certificate Authority. (note: its expensive)
Q: With which AWS services can I use ACM certificates?
You can use public and private ACM certificates with the following AWS services:
• Elastic Load Balancing – Refer to the Elastic Load Balancing documentation
• Amazon CloudFront – Refer to the CloudFront documentation
• Amazon API Gateway – Refer to the API Gateway documentation
• AWS Elastic Beanstalk – Refer to the AWS Elastic Beanstalk documentation
• AWS CloudFormation – Support is currently limited to public certificates that use email validation. Refer to the AWS CloudFormation documentation
In addition, you can use private certificates issued with ACM Private CA with EC2 instances, containers, IoT devices, and on your own servers.
Alternatively, you can use Let's Encrypt, a service provided by EFF, for free. They have a tool called CertBot to automatically renew the certificates for you.
I have a EC2 instance running in my account, now I need to add an SSL certificate to my web server running inside that EC2 instance.
Can I create a new cloudfront and attach my existing EC2 instance to it? Would that solve my purpose?
Yes, you make CloudFront point to an EC2 instance or any server really. Check out Requiring HTTPS for Communication Between Viewers and CloudFront for more information on how to do this.
Another option for free SSL certificates is Let’s Encrypt. Super easy to setup and works with Apache and Nginx.
Suppose I have a RESTful API that sits on a Windows EC2 cluster, behind an ELB. The existing API is a .NET application and hosted in IIS.
I want to try and put AWS API Gateway in front of the existing API, so that security, scalability, etc. is handled by AWS. Essentially set up AWS Gateway as a HTTP proxy to the existing API.
From the AWS documentation it states that the existing API must be made public. But it should be secured by verifying the calls are originating from Amazon API Gateway by checking the client side certificate.
http://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html
However the SSL connections for the existing API are terminated at the ELB. Hence when we check the client certificate, on the request, in code - it doesn't exist.
What would need to be done to get the client certificate at the EC2/IIS/code level?
Or is there an alternative way to secure the existing API and ensure AWS API Gateway can still communicate with it?
You will need to configure your set up your ELB to do TCP based load balancing and terminate SSL connection on your IIS/EC2 hosts. This will require distributing the SSL certificate to the hosts and configuring them to bind the certificate to the appropriate port.
Usually people prefer to offload SSL at their API gateway to save administrative overhead since ELB termination effectively moves the management to a single point in the infrastructure, rather than requiring management of the SSL certs on multiple servers.
It also helps if you are having a EC2 cluster managed by some orchestrator [ECS, kubernetes, Docker Swarm]. As you already mentioned that API gateway to load balancer is secured by SSL certificates, you can add access policy at load balancer to provide required permission to interact with your EC2 cluster, while your EC2 exist in private VPC, you may don't need to add certificates to your EC2 machines as all communication is already secured.
Hope it make sense.
AWS has come up with a new service AWS Certificate Manager. One thing I got from the description is that if we are using this service we don't have to pay for the certificate anymore.
They are providing certificates for Elastic Load Balancer (ELB) and CloudFront, but I didn't find EC2 anywhere.
Is there any way to use the certificate with EC2?
Q: Can I use certificates on Amazon EC2 instances or on my own servers?
No. At this time, certificates provided by ACM can only be used with specific AWS services.
Q: With which AWS services can I use certificates provided by ACM?
You can use ACM with the following AWS services:
• Elastic Load Balancing
• Amazon CloudFront
• AWS Elastic Beanstalk
• Amazon API Gateway
https://aws.amazon.com/certificate-manager/faqs/
You can't install the certificates created by Amazon Certificate Manager (ACM) on resources you have direct low-level access to, like EC2 or servers outside of AWS, because you aren't provided with access to the private keys. These certs can only be deployed on resources managed by the AWS infrastructure -- ELB and CloudFront -- because the AWS infrastructure holds the only copies of the private keys for the certificates that it generates, and maintains them under tight security with auditable internal access controls.
You'd have to have your EC2 machines listening behind CloudFront or ELB (or both, cascaded, would also work) in order to use these certs for content coming from EC2... because you can't install these certs directly on EC2 machines.
No, you cannot use aws certificate manager for deploying certs on EC2. The certificate manager certs can only be deployed against cloudfront and elastic load balancer. Inoredr to use it on ec2, you need to put elb on top of ec2, so that request from client to load balancer will be https protected and from elb to ec2 webserver will be on http.
If you are using AWS ACM Cert for internal purpose only then you could probably use AWS ACM Private CA to issue the certs.(I think you can use it for public/external traffic purpose as well if your root CA is publicly trusted CA).
https://docs.aws.amazon.com/acm-pca/latest/userguide/PcaGetStarted.html
During Application/EC2/Container startup, set a step to export your ACM Private CA issued Cert/Private Key to your destination and start referring that for serving the traffic.
https://docs.aws.amazon.com/cli/latest/reference/acm/export-certificate.html
One good thing is, you can control who can call export cert feature using IAM Role so not everyone can download private key of the cert.
One downside with this is, private CA is expensive AWS service($400/month).
https://aws.amazon.com/certificate-manager/pricing/
Adding to the comments above, you can't use the AWS Certificate Manager for this, but you can add a Let's Encrypt certificate to ec2 on a Windows server running IIS and it's pretty easy:
Associate an elastic ip with your ec2 instance.
Make sure you have a registered domain. You can't use ec2----------.us-east-1.compute.amazonaws.com type names that come with your instance.
Through your domain provider's DNS settings have your domain point to your Elastic IP.
Connect to your ec2 instance and add your domain name to the site bindings.
Go to https://github.com/PKISharp/win-acme/releases
Look under assets, and use the latest version (win-acme.v2.0.10.444.zip for example). This is the only assets folder that you need.
Unzip the folder, open the terminal as administrator, and cd into the unzipped folder.
Run wacs.exe and follow the prompts.
Make sure the security group assigned to your instance allows traffic (at the very least your own IP) through the HTTPS port you chose in IIS; this is port 443 by default.
I found the links below helpful when I was figuring this out. Here is a video using an earlier release if you need more help, but it's the same idea.
https://www.youtube.com/watch?v=fq5OUOjumuM
Also this article might be helpful:
https://weblog.west-wind.com/posts/2016/feb/22/using-lets-encrypt-with-iis-on-windows