AWS CloudFront Custom SSL Certificate disabled - amazon-web-services

I have seen many posts on this topic, but I have not been able to resolve the issue, so I am posting my setup in case anyone knows what needs to be changed?
I have a domain purchased through Namecheap. I have set custom DNS and added 4 name servers generated by the hosted zone in AWS Route 53. DNS lookup through whois.net shows the correct values.
In Route 53, I have added an A record to the Alias Target xxxxxxxxxxxxxx.cloudfront.net. So the traffic hits Route 53 and goes to CloudFront.
In CloudFront, I have one distribution. As Alternate Domain Names (CNAMEs), I have the following values:
*.domain.com
www.domain.com
domain.com
Under origins, I have one record with the following Origin Domain Name:
domain.com.s3-website.az-name-1.amazonaws.com
I am hosting website in an S3 bucket. All HTTP requests are set to redirect to HTTPS.
Lastly, I have created and verified a single certificate for the following domain names: domain.com, www.domain.com, *.domain.com
I have read some answers that I should just wait and the custom SSL certificate option will become enabled. It's been more than day now, however, and there is no sign of that happening.
My website works, but the misconfigured certificate (using the default *.cloudfront.net) throws a warning popup in Safari, and worse, a warning page in Chrome which most people are not going to bypass.

To use an ACM Certificate with Amazon CloudFront, you must request or import the certificate in the US East (N. Virginia) region. ACM Certificates in this region that are associated with a CloudFront distribution are distributed to all the geographic locations configured for that distribution.
http://docs.aws.amazon.com/acm/latest/userguide/acm-regions.html
CloudFront is not a regional service like most of the others. It's a global service with a single home region -- us-east-1. It can't see ACM certificates in any other region (you'd create certificates in other regions if you wanted to use them with Elastic Beanstalk or Elastic/Application Load Balancers).
From the description of what you observe, you didn't create the ACM certificate in us-east-1.
Create a new cert in us-east-1, and the option to use it should become available almost immediately in CloudFront.

Related

Issue AWS certificate for a single subdomain to be used with CloudFront?

My client has a domain example.com hosted somewhere.
We need to create a subdomain cloudfront.example.com in my AWS cloud in order to make my Cloudfront Distribution accessible on that subdomain.
CF requires an SSL certificate to work with a custom domain.
I was only able to find a solution which leads to 4th level subdomains via creating an AWS Hosted Zone (3rd level domain) in my AWS account where I can then create another subdomain (4th level).
Is it possible to register a single record in my client's DNS table to point to my CF Distro?
Yes, you can use the client's DNS. What you need to do:
Use ACM to create an SSL certificate for cloudfront.example.com. You will see a necessary CNAME to confirm the SSL certificate
Add CNAME to your client's DNS that will validate the certificate
In CloudFront, define alternate domain name (CNAME) as cloudfront.example.com
In the client's DNS add a CNAME for cloudfront.example.com to point to your CloudFront distribution domain name (it's going to be some-hash.cloudfront.net)

SSL issue in Cloudfront with ELB

I am using Loadbalancer with Amazon ACM. I have pointed A record to ELB in Route 53 ALand it works perfect with SSL and domain. But when I am pointing ELB to cloudfront getting SSL warning issue ..It would be great if someone help on this.
When you have your domain in CloudFront you need to ensure you attach a valid SSL from ACM (within us-east-1) for the domain you'll be loading. In addition ensure you have added your domain under the additional domains property.
Without this you will be loading the CloudFront default SSL which is invalid for your host domain name.
More information about setting this up is available on the Using Custom URLs for Files by Adding Alternate Domain Names (CNAMEs) page.

Static Web Application hosted in Amazon S3 Bucket suddenly not working

The hosted application worked until yesterday but suddenly not working today.
What I have done?
Using Cloudfront - To host my website from Amazon’s edge locations with a custom SSL certificate setup for my domain.
Amazon
Certificate Manager - To get HTTPS Certificate
Hosted my client application in S3. They wanted to access their site using a domain name. To achieve this I have provided two records as given below.
Type Host Value TTL
A # IP of the client domain 600
CNAME www CloudFront distribution URL 600
The thing is Endpoint which I got while configuring Cloudfront "d3ajo2v2g7lf33.cloudfront.net" is working but the domain name which I added as an alias to this endpoint is not working.
Probable findings from my side:
1) Used let's encrypt to get the SSL and it's about to expire within a week.
2) Added A record with the IP address of the domain. As am using Cloudfront am doubting that the domain does not have a static IP.
Also please let me know CloudFront distribution domain name IP will change every time or will it be static.
Kindly help me to resolve this.
CloudFront has CNAME record as well. So you have to register your domain name in the CloudFront distribution.
as for the SSL certificate for your custom domain, take a look at AWS ACM. It may be easier than using lets encrypt certificate (your call).
and yes. use the cloudfront's domain URL. it won't change unless you delete the distribution.

AWS CloudFront Custom domain name with HTTPS not working

1.I have a domain purchased through godaddy. I have set custom DNS and added 4 name servers generated by the hosted zone in AWS Route 53. DNS lookup through whois.net shows the correct values.
2.In Route 53, I have added an A record to the Alias Target xxxxxxxxxxxxxx.cloudfront.net. So the traffic hits Route 53 and goes to CloudFront.
3.In CloudFront, I have one distribution. As Alternate Domain Names (CNAMEs), I have the following values:
*.domain.com / www.domain.com / domain.com
Under origins, I have one record with the following Origin Domain Name:
domain.com.s3-website.az-name-1.amazonaws.com
4.I am hosting website in an S3 bucket. All HTTP requests are set to redirect to HTTPS.
5.Lastly, I have created (US East (N. Virginia) region) and verified a single certificate for the following domain names: domain.com, www.domain.com, *.domain.com
I have read some answers that I should just wait and the custom SSL certificate option will become enabled. It's been more than day now, however, and there is no sign of that happening.
My website works in http mode, but not in https url. Any solution ...Please help...
PS. I am new to aws, please help me...
HTTPS settings was working perfectly as cloudfront url was working as expected so I realized it was just a DNS issue. All it took was an TYPE A record pointing to it.
Solution :
Add/edit proper "TYPE A" record with "Alias Target" as a cloudfront url.
Credit : Setup AWS S3 static website hosting using SSL (ACM)
Can you confirm whether you have used ACM to generate the SSL certificate? Or you are using SSL certificate from other vendors?
STEP 1:
If you have generated the SSL Certificate from ACM, please make sure you did that with US East (N. Virginia) region. Because, CloudFront being an AWS service which is not tied to any specific region, it will use the certificates from US East region only.
STEP 2:
1. Use the "Request or Import a certificate" option in CloudFront
2. Select the certificate which you generated
3. Complete the setup and try
If everything else is setup fine, you should be able to access the contents with HTTPS after the above step.
Let me know in case it didn't work
For anyone else coming across this issue, the button was greyed out for me also and YES, I had requested the ACM cert in us-east-1.
The fix was to try in the Edge browser instead of Chrome.
For me the solution was very simple... I failed to add "Alternate Domain Name", once I did everything clicked.

Routing example.at to S3 bucket and *.example.at to load balancer with HTTPS

I have set up a multi tenant application which should be available to clients via a subdomain (e.g. https://client1.example.at). Requests to *.example.at are routed to a load balancer via Route 53. The load balancer has an AWS signed wildcard certificate (e.g. supporting example.at and *.example.at). From this side, everything is working as expected and I can access https://client1.example.at, https://client2.example.at, etc.
Based on this setup, I wanted to route specific request without subdomain (except www) such as https://www.example.at or https://example.at to a bucket (which is also named www.example.com) and not to the load balancer (I just want to serve a static site for requests to the "main domain"). It works but I can only access www.example.at and example.at without using HTTPS. My setup can be seen below:
I then found out that I have to use Cloudfront in order to use HTTPS for a custom domain with S3 buckets (if that is correct?). Now I have a few questions:
Is it necessary to use Cloudfront to serve content from my S3 bucket for www.example.at and example.at via HTTPS?
If Cloudfront is necessary then I have to request a new certificate for www.example.at and example.at in region US EAST according to the official AWS docs. Is it possible to create two certificates for the same domain with AWS certificate manager or can I get some conflicts with this setup?
Is it ok to use *.example.at as A type record with alias to the load balancer at all?
Generally speaking, is my Route 53 setup valid at all?
I wanted to route specific request without subdomain (except www) such as https://www.example.com or https://example.com to a bucket (which is also named www.example.com)
Each of those "domains" must route to a different bucket unless you are using a proxy (which reroutes the hostname passed from the browser) in front of S3, the domain name must match the bucket name. If they don't then your requests are going to a bucket matching the DNS name you routed from, the routing has nothing to do with the hostname of the S3 bucket endpoint.
In other words, let's say your hostname was www.example.com, and you set the CNAME to example.com.s3.amazonaws.com (or you could use the website endpoint, it doesn't matter for this example).
When a request hits the DNS name www.example.com it then is sent to the S3 server which is behind the S3 hostname. That request from the browser is for hostname "www.example.com", the actual CNAME referenced which pointed to the S3 endpoint is irrelevant because S3 never knows what actual CNAME was used to by your browser to connect to S3. So S3 will attempt to pull the requested object from the www.example.com bucket.
URL -> S3 Bucket
https://www.example.com -> s3://www.example.com
https://example.com -> s3://example.com
It works but I can only access www.example.at and example.at without using HTTPS.
CNAME DNS routing like this when using SSL to an S3 bucket does not work. The reason for this is that the S3 wild card certificates are 1 level deep (*.s3.amazonaws.com) so your bucket www.example.com.s3.amazonaws.com will fail to match it because it has 2 extra levels above the wild card. So your browser rejects the certificate as invalid for the hostname.
To accomplish this you must use a proxy of some sort in front of S3 with your own certificates for the domain in question.
Is it necessary to use Cloudfront to serve content from my S3 bucket for www.example.at and example.at via HTTPS?
CloudFront is an excellent option for addressing the HTTPS with CNAME routed DNS to an S3 bucket issue we just mentioned.
If Cloudfront is necessary then I have to request a new certificate for www.example.at and example.at in region US EAST according to the official AWS docs. Is it possible to create two certificates for the same domain with AWS certificate manager or can I get some conflicts with this setup?
I can't answer that one, I can only suggest you try and find out what happens. If it doesn't work then it's not an option. It shouldn't take much time to figure this one out.
Is it ok to use *.example.at as A type record with alias to the load balancer at all?
To clarify, an A Record can only ever be an IP address, an A Alias is similar to a CNAME (but is Route53 specific).
I highly recommend CNAMES (or ALIASES, they are similar). Pointing directly at one of S3's A-Records is a bad idea because you don't know if or when that IP will be removed from service. By referencing the hostname with a CNAME/ALIAS you don't have to worry about that. Unless you can be 100% sure that the IP will remain available then you shouldn't reference it.
Generally speaking, is my Route 53 setup valid at all?
I don't see any issues with it, based on what you described it sounds like like things are working as expected.
If Cloudfront is necessary then I have to request a new certificate for www.example.at and example.at in region US EAST according to the official AWS docs. Is it possible to create two certificates for the same domain with AWS certificate manager or can I get some conflicts with this setup?
As suggested by #JoshuaBriefman I simply tried to create another certificate for the same domain in another region now and it worked. I could also use the certificate for the CloudFront distribution (additional certificate was created in US EAST) and all works now without any problems so far.