AWS - Apache application behind app load server not using SSL certificate - apache

I have placed my instances behind an ALB that has an ACM provided SSL certificate configured with it. However, when I browse to the web page (that I have configured via Route53's alias record to the App Load Balancer), it says that my connection is not secure.
What am I doing wrong here? Do I need to configure Apache somehow?

I got help from the following site. Added the code below to an .htaccess file that I placed at the app root, i.e., /var/www/html.
Caveat: Be aware that even though my app was running behind a load balancer, .htaccess is disabled by default in EC2 as a security measure and therefore needs to be be enabled by editing etc/httpd/conf/httpd.conf, where you change AllowOverRide = None to AllowOverRide = All
Code for .htaccess:
# Begin force ssl
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} 443
RewriteRule ^(.*)$ https://your-domain/$1 [R,L]
</IfModule>
Restart apache once you've got this in there. sudo service httpd restart.
If it still doesn't work, clear browser cache. If it doesn't work for www.your-domain.com, it is quite possible that you ordered the certificate for your-domain.com only. Make a new certificate (they are free), with both names added to it.

Related

Rewrite subdomain.domain.com to domain.com/subdomain without redirect

I've read plenty of Stackoverflows but I seem to be missing something.
I have a PHP application running on https://subdomain.example.com/page/x but for SEO reasons I want people/bots to see https://example.com/subdomain/page/x.
I can rewrite the URL by using:
RewriteEngine on
RewriteCond %{HTTP_HOST} subdomain.example.com
RewriteRule ^(.*)$ https://example.com/subdomain/$1 [L,NC,QSA]
This rewrite results in: https://example.com/subdomain/page/x, but I keep recieving a 404 error since the "main" domain doesn't know the path /subdomain/page/x of course.
What I want is to have the URL https://example.com/subdomain/page/x but run it on https://subdomain.example.com/ in the background since this is the place where the PHP application is running.
Is this possible? How should I do this?
There is no strong SEO reason not to use subdomains. See Do subdomains help/hurt SEO? I recommend using subdirectories most of the time but subdomains when they are warranted.
One place where subdomains are warranted is when your content is hosted on a separate server in a separate hosting location. While it is technically possible to serve the content from a subdirectory from the separate server, that comes with its own set of SEO problems:
It will be slow.
It will introduce duplicate content.
From a technical standpoint, you would need to use a reverse proxy to on your example.com webserver to fetch content for the /subdomain/ subdirectory from subdomain.example.com. The code for doing so in the .htaccess file of example.com would be something like:
RewriteEngine on
RewriteRule ^subdomain/(.*)$ https://subdomain.example.com/$1 [P]
The [P] flag means "reverse proxy" which will cause the server to fetch the content from the remote subdomain. This will necessarily make it slower for users. So much so that it would be better for SEO to use a subdomain.
For this to work you would also need to leave the subdomain up and running and serving content for the main server to fetch. This causes duplicate content. You could solve this issue by implementing canonical tags pointing to the subdirectory.
This requires several Apache modules to be available. On my Debian based system I needed to run sudo a2enmod ssl proxy rewrite proxy_connect proxy_http and sudo service apache2 reload. I also had to add SSLProxyEngine on in my <VirtualHost> directive for the site I wanted to use this on.

How to Load My Non-Public Site via HTTP (No SSL Config) - All Browsers Auto-Redirect to HTTPS

I need to load my website via HTTP, but all browsers automatically redirect to HTTPS. I have no SSL setup on the site (the domain name is not registered anywhere), nor is the server expecting SSL (AFAIK).
I also run into this when I register a new domain name or make DNS changes for a site and set the IP in my hosts file before the DNS records can propagate, but this is usually resolved within an hour or two.
I manually added a development domain to my servers (not registered anywhere) and manually added the domain to my hosts file.
123.456.789.1 example.dev
I never setup SSL or HTTPS on the server for the domain, but Chrome/Edge/Firefox refuses to load the site over HTTP.
It is a WordPress installation, and I have the URL set to http://example.dev.
option_id | option_name | option_value | autoload
1 | siteurl | http://example.dev | 1
I tried deleting the HSTS settings on the domain in the browser via (chrome|chromium|edge)://net-internals/#hsts.
I set up a 301 to HTTP from HTTPS in the .htaccess file on the site, and a couple other things that escape my memory at this time.
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTPS} =on [NC]
RewriteRule ^(.*)$ http://%{HTTP_HOST}/$1 [R=301,L]
</IfModule>
Still, no luck. What else can I do to force HTTP on my non-public site?
EDIT:
It seems as though Chrome now requires all *.dev to have HSTS and HTTPS. I have since begun using a *.test domain name, and my issues are resolved.
HSTS is forced on .dev domains by the browsers.
You will have to use a different domain or set up HTTPS for your web server.
https://ma.ttias.be/chrome-force-dev-domains-https-via-preloaded-hsts/

virtual host settings for typo3

DocumentRoot "C:/xampp_7/htdocs/BackupForEdow/Eddddddddd"
<Directory C:/xampp_7/htdocs/BackupForEdow/Eddddddddd>
AllowOverride All
Order Allow,Deny
Allow from All
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond {REQUEST_FILENAME} !-f
RewriteRule . /index.php [L]
</IfModule>
</Directory>
Is this correct for a typo3 project?
I am not able to access the frontend of typo3 but my backend works correctly. The front-end shows an internal server error.
Please help me to create the virtual host.
The vhost really does depend on other things: For example if you use the shipped .htaccess, you don't need the rewrite statements.
Copy the _.htaccess from the TYPO3 source to .htaccess in your document root for that.
About errors in general: As already recommended, look in the Apache (or php) error logs. Also look in the TYPO3 system log ("Log" in the Backend).
About the certificate error: You need to set up an SSL/TLS certificate if you want to be able to access your website via https://. This is not a TYPO3 specific thing. You may want to consult other resources, e.g. search on stackoverflow.
Perhaps this helps.
Also, check if you can load your webpage via http://
For ssl in general you need these things:
Create a signed certificate. Your hoster should be able to help you with that. If you are setting up your TYPO3 installation on your desktop PC, you can skip that part for now and override the error message in the browser. For a public website you should always setup your certificates correctly, though.
Make sure the Apache ssl modules are enabled. I don't know enough about Xampp to help you there.
Create and enable a vhost file for ssl / port 443. Look for an existing example ssl vhost files in the sites-available directory, e.g. default-ssl.conf or search for examples online
Having a not correct server name in the certificate should usually not lead to a 500 error. It should generate a warning in the browser.

HTTP Post request to aws ec2 directory /opt/lampp/htdocs/donate/ denied

I am trying to make a post request to http://localhost/donate/payment.php".
It works fine when I run the application locally
However when I change the URL to
"http://ec2-xx-xxx-xx-xxx.ap-southeast-2.compute.amazonaws.com/opt/lampp/htdocs/donate/payment.php"
I get page not found error. I can guarantee that the file is present in the location.
I have tried several things like changing the permission of the the /opt file recursively to 777. Also tried changing the apache server port default port from 80.
I even tried placing a .htacces file inside the donate folder to access the server. the contents are
RewriteEngine On
RewriteCond %{HTTP_HOST} ^yourdomain.com
RewriteRule (.*) http://www.yourdomain.com/$1 [R=301,L]
RewriteCond %{HTTP_HOST} ^www\.yourdomain\.com$
RewriteCond %{REQUEST_URI} !^/WebProjectFolder/
RewriteRule (.*) /WebProjectFolder/$1
All attempts have failed. Is there anything else I am missing here. I have installed bitnami parse server and I am able to access that by http in the browser. It is present in the folder /apps in the root folder.
Does AWS override any security permissions?
Assuming /opt/lampp/htdocs/is your document root, shouldn't the URL be http://ec2-xx-xxx-xx-xxx.ap-southeast-2.compute.amazonaws.com/donate/payment.php?
You might also want to verify a couple of things:
Make sure your security policy has its inbound port 80 open to the public (or where you'll be visiting from)
Assuming you're using Apache httpd, make sure it accepts connections on the external interface or all interfaces (e.g. Listen 80, Listen 0.0.0.0:80, etc)
First, if you actually get an error from your Apache server, the issue has nothing to do with AWS. If there were misconfigured security groups or NACL, you'd never reach port 80 (http).
Second, never ever chmod -R 777, not only can you break your app behavior, but also, especially with PHP, you just opened security risks. Yes, this doesn't matter until your instance becomes part of a botnet and starts sending spam.
At a glance, I would say your Apache configuration lacks something, like a VirtualHost "any":
# from https://httpd.apache.org/docs/2.4/vhosts/examples.html
<VirtualHost *:80>
DocumentRoot "/www/example1"
ServerName www.example.com
# Other directives here
</VirtualHost>
It seems like your default location points to another directory, possibly the default one.

How to force https on elastic beanstalk?

I can't seem to force https on the free usage tier of elastic beanstalk.
I have tried the following suggestion at How to force https on amazon elastic beanstalk without failing the health check
Using this Apache rewrite rule
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{REQUEST_URI} !^/status$
RewriteCond %{REQUEST_URI} !^/version$
RewriteCond %{REQUEST_URI} !^/_hostmanager/
RewriteRule . https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
When I try that, http requests do not get redirected to https as I would like. Instead, the http page loads normally. I've also tried to use the X-Forwarded-Port header with the same result.
I've also tried the following rewrite rule
RewriteCond %{SERVER_PORT} 80
RewriteRule . https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
And this rule causes a redirect loop. So it would seem that the apache rewrite rules don't pick up the Elastic Load Balancer headers X-Forwarded-Port and X-Forwarded-Proto, but also a redirect loop isn't what I am going for either.
Please help. I am new to AWS, Elastic Beanstalk, and not very familiar with Apache rules. I am not too sure where to go from here. Thanks.
This answer assumes you have already enabled https in the load balancer security group, added the SSL certificate to the load balancer, have both ports 80 and 443 being forwarded by the load balancer, and pointed your domain name at the Elastic Beanstalk environment with Route 53 (or equivalent DNS service).
Option 1: Do the redirect with Apache
This is only possible if you are on an Elastic Beanstalk environment that uses Apache (AWS Linux 2 based deployments can be configured to use Apache). It may not work for a docker-based deployment.
Amazon Linux 2
Most AWS Linux version 2 based platforms have the option to pick Apache as your proxy host. This can be done by going to "Configuration" > "Software" >
"Container Options" and setting "Proxy Server" to "Apache", or adding the following to one of your .config files in .ebextensions:
option_settings:
aws:elasticbeanstalk:environment:proxy:
ProxyServer: apache
Having done that, add a configuration file named .platform/httpd/conf.d/ssl_rewrite.conf to your codebase (relevant AWS docs) with the following contents:
RewriteEngine On
<If "-n '%{HTTP:X-Forwarded-Proto}' && %{HTTP:X-Forwarded-Proto} != 'https'">
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
</If>
Amazon Linux 1
All you need to do is add the following to one of your .config files in the .ebextensions directory of your project:
files:
"/etc/httpd/conf.d/ssl_rewrite.conf":
mode: "000644"
owner: root
group: root
content: |
RewriteEngine On
<If "-n '%{HTTP:X-Forwarded-Proto}' && %{HTTP:X-Forwarded-Proto} != 'https'">
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
</If>
Explanation
This is moderately straight forward outside of Elastic Beanstalk. One usually adds an Apache rewrite rule like the following:
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
Or, if behind a load balancer, like we are in this case:
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
However, these configurations only work within a <VirtualHost> block. Changing the RewriteCond to an <If> block allows it to work properly outside of a <VirtualHost> block, allowing us to put in in a standalone Apache config file. Note that standard Apache setup on CentOS (including the setup on ElasticBeanstalk) inculdes all files matching /etc/httpd/conf.d/*.conf, which matches the file path where we are storing this file.
The -n '%{HTTP:X-Forwarded-Proto}' part of the condition prevents it from redirecting if you are not behind a load balancer, allowing you to have shared configuration between a production evironment with a load balancer and https, and a staging environment that is single instance and does not have https. This is not necessary if you are using load balancers and https on all of your environments, but it doesn't hurt to have it.
Option 2: Do the redirect with the ALB
This is only possible if you are using an Application Load Balancer. Amazon has instructions for how to do that here: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-httpredirect.html
All you need to do is add the following to one of your .config files in the .ebextensions directory of your project to replace the http listener with a redirect:
Resources:
AWSEBV2LoadBalancerListener:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
LoadBalancerArn:
Ref: AWSEBV2LoadBalancer
Port: 80
Protocol: HTTP
DefaultActions:
- Type: redirect
RedirectConfig:
Host: "#{host}"
Path: "/#{path}"
Port: "443"
Protocol: "HTTPS"
Query: "#{query}"
StatusCode: "HTTP_301"
Bad solutions I have seen
I have seen a lot of bad solutions to this problem, and it is worth going through them to understand why this solution is necessary.
Use Cloudfront: Some people suggest using non-cached Cloudfront setup in front of Elastic Beanstalk to do the HTTP to HTTPS redirect. This adds a whole new service (thus adding complexity) that isn't exactly appropriate (Cloudfront is a CDN; it's not the right tool for forcing HTTPS on inherantly dynamic content). Apache config is the normal solution to this problem and Elastic Beanstalk uses Apache, so that's the way we should go.
SSH into the server and...: This is completely antithetical to the point of Elastic Beanstalk and has so many problems. Any new instances created by autoscaling won't have the modified configuration. Any cloned environments won't have the configuration. Any number of a reasonable set of environment changes will wipe out the configuration. This is just such a bad idea.
Overwrite the Apache config with a new file: This is getting into the right realm of solution but leaves you with a maintenance nightmare if Elastic Beanstalk changes aspects of the server setup (which they very well may do). Also see the problems in the next item.
Dynamically edit the Apache config file to add a few lines: This is a decent idea. The problems with this is that it won't work if Elastic Beanstalk ever changes the name of their default Apache config file, and that this file can get overwritten when you least expect: https://forums.aws.amazon.com/thread.jspa?threadID=163369
EDIT: While I love this answer, it is now very old. AWS has come up with new services (like Certificate Manager) that make part of this answer obsolete. Additionally, using the .ebextensions folder with Apache is a cleaner way to handle this redirect as explained above.
If you are hosting your website on S3, parts of this answer may still be useful to you.
This worked for me:
Upload the certificate to AWS using the aws console command. The command structure is:
aws iam upload-server-certificate --server-certificate-name CERTIFICATE_NAME --certificate-body "file://PATH_TO_CERTIFICATE.crt" --private-key "file://YOUR_PRIVATE_KEY.pem" --certificate-chain "file://YOUR_CERTIFICATE_CHAIN.ca-bundle" --path /cloudfront/
In your Elastic Beanstalk application, go to Configuration -> Network Tier -> Load Balancing and click the gear icon.
Select Secure listener port as 443. Select Protocol as HTTPS. Select the CERTIFICATE_NAME from step 2 for SSL certificate ID. Save the configuration.
Go to your Console. Click EC2 Instances. Click Load Balancers. Click through the load balancers. Click Instances and scroll down to see the EC2 instances assigned to that load balancer. If the EC2 instance has the same name as your Application URL (or something close), take note of the DNS Name for the load balancer. It should be in the format awseb-e-...
Go back to your Console. Click CloudFront. Click Create Distribution. Select a Web distribution.
Set up the distribution. Set your Origin Domain Name to the load balancer DNS name you found in step 5. Set the Viewer Protocol Policy to Redirect HTTP to HTTPS. Set Forward Query Strings to Yes. Set Alternate Domain Names (CNAMEs) to the URL(s) you want to use for your application. Set SSL Certificate to the CERTIFICATE_NAME you uploaded in step 2. Create your distribution.
Click on your distribution name in CloudFront. Click Origins, select your origin, and click Edit. Ensure your Origin Protocol Policy is Match Viewer. Go back. Click Behaviors, select your origin, and click Edit. Change Forward Headers to Whitelist and add Host. Save.
Note: I wrote a longer guide as well.
With the new Application Load Balancers you can do this fairly trivially now...
Ensure you setup one of these at the time you setup an EB environment (still defaults to classic load balancer I believe). You could not change the type once the environment is created, so recreate it
Once this is done, go to your EC2 settings -> Load Balancers. Click on the load balancer you created for your EB environment.
You must ensure that you have setup a HTTPS listener prior to this task so make sure you listen on HTTPS 443 with an SSL cert and forward traffic to your instances with HTTP on 80.
Then add a new listener which listens on HTTP and add a default action of "Redirect to:". Make sure you set HTTPS as the protocol, 443 as the port, "Original host, path, query" as the option and finally 301 as the HTTP response code.
Once this listener is added ensure that you update your EC2 Load Balancer security group to accept both HTTPS and HTTP connections, you will see small warning sign on the listener to remind you!
Chris
The most upvoted doesn't work for me.. the <If> directive only works with Apache 2.4+, but ElasticBeanstalk has version 2.2.x.
So, following the same advice as above. Create a file called .ebextensions/https_rewrite.config with the following content
files:
"/etc/httpd/conf.d/ssl_rewrite.conf":
mode: "000644"
owner: root
group: root
content: |
LoadModule rewrite_module modules/mod_rewrite.so
RewriteEngine On
# This will enable the Rewrite capabilities
RewriteCond %{HTTPS} !=on
# This checks to make sure the connection is not already HTTPS
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
This seems to work for me.
On how to build this file into your WAR file, see this answer
Edit: Zags solution is more general and correct. I recommend it over mine (which is specific to a python env)
Here's a clean and quick solution that I came up with that avoids hacking wsgi.conf or using CloudFront
In your .ebextensions/some_file.config:
# Redirect HTTP to HTTPS
"/etc/httpd/conf.d/https_redirect.conf":
mode: "000644"
owner: root
group: root
content: |
<Directory /opt/python/current/app/>
RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} ^http$
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</Directory>
I feel like this is too easy, but seems to be working fine.
Also note that I am explicitly redirecting HTTP instead of "not HTTPS".
I am trying to redirect an elastic beanstalk with loadbalancer in 2018. None of the above answers works in my environment. Several issues I encoutered:
I was trying the most voted answer, but my tomcat is version 2.7. It does not support .
I was using container_commands and copy the 00_applications setting. AWS simply ignores it.
So finally I got it working by reading this:
https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/java-tomcat-proxy.html
Here is what I do:
I recreated the folder structure:
.ebextensions
- httpd
-conf.d
-ssl.conf
And then this is the content of ssl.conf
<VirtualHost *:80>
RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
<Proxy *>
Order Allow,Deny
Allow from all
</Proxy>
ProxyPass / http://localhost:8080/ retry=0
ProxyPassReverse / http://localhost:8080/
ProxyPreserveHost on
ErrorLog /var/log/httpd/elasticbeanstalk-error_log
</VirtualHost>
Hope this will help.
It's work for me with the next command:
RewriteCond %{HTTP:X-Forwarded-Port} !=443
and without the https check:
RewriteCond %{HTTP:X-Forwarded-Proto} !https
It's look like ELB change the value of X-Forwarded-Proto to http (even on TCP protocol).
None of the above answers worked for me but some helped me to figure out the answer that worked for me
Also I found the below url which helped
http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/java-tomcat-platform.html
I created the file structure mentioned in above url to change 2 files
httpd.conf
00_application.conf
copy the whole httpd.conf from your instance and put it in your code under .ebextention under the folder structure mentioned in the above link. Then just add below line to that file in your project
LoadModule rewrite_module modules/mod_rewrite.so
Do that same for 00_application.conf, copy it from your instance and place it in your codebase under .ebextention under httpd/conf.d/elasticbeanstalk/00_application.conf
Now edit this file and add the below between VirtualHost
RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Now deploy your code
It should work.
On elastic beanstalk you can just add your on configuration so that AWS overwrite their, it will allow you to overwrite the web-server configuration and submit your own configuration.
Simply add the following file under the path: .ebextensions\httpd\conf.d
File content:
<VirtualHost *:80>
LoadModule rewrite_module modules/mod_rewrite.so
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{HTTP_USER_AGENT} !ELB-HealthChecker
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyPass / http://localhost:8080/ retry=0
ProxyPassReverse / http://localhost:8080/
ProxyPreserveHost on
ErrorLog /var/log/httpd/elasticbeanstalk-error_log
</VirtualHost>
The '.ebextensions' is the standard configuration folder in AWS and the rest just point to which file and folder you wish to overwrite.
If the file or folder doesn't exist simple create them.
I had a difficult time figuring this out so after I came up with a solution I wrote a detailed explanation of my solution to hopefully help someone else. This is specific to Tomcat 8, Apache2, and Spring Boot app. There are really useful ebextension examples in the AWS labs github.
Summary of what worked for me:
Create a file at /src/main/webapp/.ebextensions/httpd/conf.d/elasticbeanstalk.conf
Add rewrite conds/rules being careful to include "LoadModule rewrite_module modules/mod_rewrite.so"
Deploy to AWS EBS
Here is an example Spring Boot app.
I have following configurations for elastic beanstalk (64bit Amazon Linux 2016.09 v2.3.1 running Tomcat 8 Java 8).
I created a directory .ebextensions and added a .config YAML file with the rewrite conditions
Zagas solution described above (which is very complex) doesn't work for me.
Because "If" condition is unknown
Because of Apache 2.2 I don't have mod_rewrite.so included in my httpd.conf file
This solution make more sense for me, but also this doesn't work. Nothing happens, and I cannot see file "ssl_rewrite.conf" under "conf.d" directory.
Third tried solution was to add "run.config" and "ssl_rewrite.conf" files under ".ebextendsion" directory.
run_config contains
container_commands:
copy-config:
command: "cp .ebextensions/ssl_rewrite.conf /etc/httpd/conf.d"
ssl_rewrite.conf contains
LoadModule rewrite_module modules/mod_rewrite.so
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule . https://%{HTTP:Host}%{REQUEST_URI} [L,R=permanent]
ssl_rewrite.conf is created under "conf.d" direcotry but redirect from http to https doesn't work.
The only worked solution for me was to add the following lines in "/etc/httpd/conf.d/elasticbeanstalk/00_application.conf"
<VirtualHost *:80>
......
RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
......
</VirtualHost>
but this is a temporary solution and if a machine is replaced my https redirection is gone.
Just in case anybody is still struggling:
I've struggled for some time and finally, I've found a GitHub (from AWS team) with all AWS configs and the example below works for the HTTP>HTTPS redirection for Apache 2.2. (For configs for Apache 2.4 and Nginx please see the link below).
Apache 2.2
Create a file in the root directory of your app:
YOUR_PROJECT_ROOT/.ebextensions/httpd/conf.d/elasticbeanstalk.conf
(In case of using IntelliJ / Java make sure it go added to the final .WAR artifact)
Add the following lines to enable the redirection in the virtual host:
<VirtualHost *:80>
LoadModule rewrite_module modules/mod_rewrite.so
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{HTTP_USER_AGENT} !ELB-HealthChecker
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyPass / http://localhost:8080/ retry=0
ProxyPassReverse / http://localhost:8080/
ProxyPreserveHost on
ErrorLog /var/log/httpd/elasticbeanstalk-error_log
</VirtualHost>
For more examples for Apache 2.4 and Nginx please visit this GitHub repository:
https://github.com/awsdocs/elastic-beanstalk-samples/tree/master/configuration-files/aws-provided/security-configuration/https-redirect/java-tomcat
Also, there is plenty more useful configuration and examples available.
Regards
Enabling HTTPS through an environment variable
I needed to enforce HTTPS only for our production environment, and not for the development and staging ones which are also on Elastic Beanstalk but do not use a load balancer (and therefore cannot be assigned a certificate directly).
I use an environment variable USE_HTTPS. We copy the the ssl_rewrite.conf file if and only if USE_HTTPS is set to true.
.ebextensions/files/ssl_rewrite.conf
RewriteEngine On
<If "-n '%{HTTP:X-Forwarded-Proto}' && %{HTTP:X-Forwarded-Proto} != 'https'">
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</If>
.ebextensions/https.config
files:
"/home/ec2-user/https_setup.sh":
mode: "000755"
owner: root
group: root
content: |
#!/bin/bash
echo "USE_HTTPS env var: ${USE_HTTPS,,}"
outfile=/etc/httpd/conf.d/ssl_rewrite.conf
if [ "${USE_HTTPS,,}" == "true" ]; then
echo "Configure SSL rewrite"
cp .ebextensions/files/ssl_rewrite.conf $outfile
chmod 644 $outfile
chown root:root $outfile
else
[ -f $outfile ] && rm $outfile
echo "Do not use SSL"
exit 0
fi
container_commands:
01_https_setup:
command: "/home/ec2-user/https_setup.sh"
Note that if you change USE_HTTPS, you need to redeploy your application for the change to take effect. You can also remove the echo commands in the https.config file if you wish.
AWS has also some documentation on this.
If you're using an application load balancer, add the file http-to-https.config to your .ebextensions folder and then add the following config (Don't forget to put in the ARN of your https certificate):
NOTE: Please be sure that you haven't yet added a listener on port 443 via the EB console. If you did so, delete the listener before adding the .config file.
Resources:
AWSEBV2LoadBalancerListener:
Type: 'AWS::ElasticLoadBalancingV2::Listener'
Properties:
DefaultActions:
- Type: redirect
RedirectConfig:
Protocol: HTTPS
Port: '443'
Host: '#{host}'
Path: '/#{path}'
Query: '#{query}'
StatusCode: HTTP_301
LoadBalancerArn:
Ref: AWSEBV2LoadBalancer
Port: 80
Protocol: HTTP
AWSEBV2LoadBalancerListenerHTTPS:
Type: 'AWS::ElasticLoadBalancingV2::Listener'
Properties:
Certificates:
- CertificateArn: Replace with Certificate ARN
DefaultActions:
- Type: forward
TargetGroupArn:
Ref: AWSEBV2LoadBalancerTargetGroup
LoadBalancerArn:
Ref: AWSEBV2LoadBalancer
Port: 443
Protocol: HTTPS
The advantage of using your LB for this is that your config will be agnostic to the server you use like nginx, apache, etc.
I found an answer from here to be helpful.
All I did was make the health check path /index.php instead of / in the application load balancer default process.
Why don't you simply put an .htaccess file in the root folder? That way you can simply test and debug it. And if you include it in the .zip, it will automatically deployed on all instances again.
Simply use .htaccess:
RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
Please note that the most voted answer is a bit old now.
The answer by A Paul is actually the correct answer. The link provided in his answer is by AWS (so it is the recommended method to override your Apache configuration to make the redirection from HTTP to HTTPS when running your application on Elastic Beanstalk).
There is one very important thing to note. If you are deploying more than 1 web app, then adding the .ebextensions folder inside one of your web app is not going to work. You will notice that Non of the configurations you specified are being written or created. If you are deploying multiple Web Apps on Elastic Beanstalk environment, then you will need to read this article by AWS
Java Tomcat Deploy Multiple WAR files on Elastic Beanstalk
In general, you will need to have the following structure before you issue the eb command on it to deploy the WAR files:
MyApplication.zip
├── .ebextensions
├── foo.war
├── bar.war
└── ROOT.war
if .ebextentions folder exists inside each WAR file, then you will notice that it is completely ignored and no configuration changes will be performed.
Hope this helps someone else.
We have solved it on our backend by handling X-Forwarded-Proto properly.
This is our Grails config but it will help you with the idea:
grails.plugin.springsecurity.secureChannel.useHeaderCheckChannelSecurity = true
grails.plugin.springsecurity.portMapper.httpPort = 80
grails.plugin.springsecurity.portMapper.httpsPort = 443
grails.plugin.springsecurity.secureChannel.secureHeaderName = 'X-Forwarded-Proto'
grails.plugin.springsecurity.secureChannel.secureHeaderValue = 'http'
grails.plugin.springsecurity.secureChannel.insecureHeaderName = 'X-Forwarded-Proto'
grails.plugin.springsecurity.secureChannel.insecureHeaderValue = 'https'
grails.plugin.springsecurity.secureChannel.definition = [
[pattern: '/**', access: 'REQUIRES_SECURE_CHANNEL']
]
To extend another two answers to this question https://stackoverflow.com/a/43026082/8775205, https://stackoverflow.com/a/42035023/8775205.
For spring boot users who deploy their services on AWS with ELB, and need step by step guide, you can add an ****.conf file under src/main/webapp/.ebextensions/httpd/conf.d/ in your project.
src
--main
----java
----resources
----webapps
------.ebextensions
--------httpd
----------confd
------------****.conf
****.conf looks like the following. Noticed that I have my testing site with a single instance, so I add a condition to exclude it.
<VirtualHost *:80>
LoadModule rewrite_module modules/mod_rewrite.so
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{HTTP_USER_AGENT} !ELB-HealthChecker
RewriteCond %{HTTP_HOST} !testexample.com #excludes test site
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyPass / http://localhost:8080/ retry=0
ProxyPassReverse / http://localhost:8080/
ProxyPreserveHost on
ErrorLog /var/log/httpd/elasticbeanstalk-error_log
</VirtualHost>
After this, remember to add a "resource" under maven-war-plugin in your pom.xml in order to pick up the above configuration.
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-war-plugin</artifactId>
<configuration>
<webResources>
<resource>
<!-- some other resource configured by yourself-->
</resource>
<resource>
<directory>src/main/webapps/.ebextensions</directory>
<targetPath>.ebextensions</targetPath>
<filtering>true</filtering>
</resource>
</webResources>
</configuration>
<version>2.1.1</version>
</plugin>
Finally commit and push your code, wait AWS codebuild and codepipeline to pick up your code from your repository and deploy to beanstalk environment, or simply pack your project into a war file and upload it to your AWS beanstalk environment
AWS do not accept unserscores (_) in headders, while we can use (-), So Remove underscores from the header variables, example:- header_var_val = "some value" replace it with headervarval = "some value". It works for me.
All of the above answers are outdated in 2022, since AWS made silent changes to ElasticBeanstalk without updating the documentation properly.
However it has become very simple to do it from the AWS console when using a load balancer. You just need to disable the listener on the 80 port (http) once you created the https listener (environment -> configuration -> load balancer). And that's it.
No more problem with health checks since they are performed directly on the instance, not on the load balancer.
If you use a Load Balanced environment you can follow the instructions for Configuring HTTPS for your AWS Elastic Beanstalk Environment and at the end disable the HTTP port.
Note that currently the AWS Free Usage Tier includes the same amount of hours for an Elastic Load Balancing (ELB) as for an EC2 Micro Instance.
this is an easy solution
ssh into your EC2 instance
copy the contents of /etc/httpd/conf.d/wsgi.conf into a local file called wsgi.conf which will be placed in the base folder of your application
Edit the local version of wsgi.conf and add the following redirect rules within the < VirtualHost> < /VirtualHost> tags
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule !/status https://%{SERVER_NAME}%{REQUEST_URI} [L,R=301]
Change the “/status” to whatever page you are using as a health check page.
Save the file
Edit your < app>.conf file inside your .ebextensions directory to add a container command to copy this version of wsgi.conf over Amazon’s version
container_commands:
01_syncdb:
command: "django-admin.py syncdb --noinput" leader_only: true
02_collectstatic:
command: "django-admin.py collectstatic --noinput"
03_wsgireplace:
command: 'cp wsgi.conf ../wsgi.conf'
...
Deploy the code.
The deployed version of wsg.conf at /etc/httd/conf.d/wsgi.conf will now include the necessary redirect rules.
It should work and the file will be properly updated for each deployment. The only thing to watch for is if Amazon changes their base wsgi.conf file contents in the future, then your copy may no longer work.
Autor rickchristianson