I have a standard Elastic Beanstalk app set up and running great over HTTP. There is one EC2 instance (for now), and the domain is configured with a CNAME pointing to the load balancer. Following the instructions in the AWS documentation, I inputted the SSL certificate and configured the load balancer as such:
Load balancer protocol: HTTPS
Load balancer port: 443
Instance protocol: HTTP
Instance port: 80
Cipher: [default]
SSL certificate: myCert
The changes look like they have been applied; in the load balancer description, I see:
Port configuration:
80 (HTTP) forwarding to 80 (HTTP)
Stickiness: Disabled
443 (HTTPS, Certificate: myCert) forwarding to 80 (HTTP)
Stickiness: Disabled
However, I cannot access the site at the HTTPS load balancer URL or my domain's HTTPS URL. Request times out. The HTTP site continues to work well.
Is there any additional configuration I have to do to have the server respond on HTTPS? Am I correct in assuming that there is no configuration required at the app level, since SSL is terminated at the load balancer and the app will continue to speak HTTP?
What I suspect you are missing is allowing access to your instance from your load balancer's security group.
You can see the load balancer's security group here:
Then you can see add it to your instance's security group here:
Related
I am very new to load balancers. I have just set one up that listens on SSL. I also created an EC2 instance and added it to the target group of the "Application Load Balancer". The target group is also connected by SSL.
I have installed apache on the EC2 instance and placed an index.html file in the /var/www/html directory.
I would have thought typing the load balancer associated domain address (www.example.com) would route me to the index.html file of the EC2 instance (which is the only target). However I am getting a Bad Gateway 502 error.
Initially I only had SSH inbound rule on the EC2. I opened up 443 for HTTPS but that didn't make a difference.
Do I need to install a certificate for the SSL on the EC2 as well as the load balancer? And do I need to open any additional ports?
Very new to this all and not sure how the load balancer communicates with the EC2 instance. Hoping that it would be internal so that the EC2 instance was not at all exposed in isolation.
So many things can go wrong here but (assuming that you have correctly configured the load balancer) I think what you have should work if you add HTTP listener to your load balancer, change your target group's protocol to HTTP (because the load balancer talks to the EC2 over HTTP), and then, add something like this to your .htaccess:
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule . https://%{HTTP:Host}%{REQUEST_URI} [L,R=permanent]
You can read more here.
Install the SSL certificate on the load balancer instead of the EC2. The EC2 does not need its own SSL certificate.
Here are the steps to add HTTPS to a application load balancer:
When you try to set up HTTPS inbound to the load balancer it will give you a section called "ACM" click into that to get a SSL certificate
The ACM page will give you a section to create a new SSL certificate. You will need to input the domain name and some details, afterwards it will give you a CNAME record. You need to go to your domain's DNS settings to add that new CNAME record.
Once you create a SSL certificate with ACM you'll be able to use that on the load balancer, go back to the HTTPS listener and use that new SSL certificate
Then make sure your load balancer security group allows inbound to 443 port.
After that https should work on the load balancer
Note:
I would only set up https after I get http working first on the load balancer and it is directing to the right ec2.
Since the target group for http and https is the same, you want to make sure the target group is working before messing around with https.
That way you won't have two problems to deal with at the same time (https + incorrectly configured target groups/http). It'll allow to tackle each item step by step.
Hope that helps!
I have a windows 2012 server and have applied an SSL certificate following godaddy's guide:
https://uk.godaddy.com/help/iis-7-install-a-certificate-4801
I have applied the binding on the site in IIS however when I try to view the https site I get "refused to connect".
I have updated the firewall setting to allow port 443.
Any ideas?
It was due to my site using a load balancer.
An additional load balancer for port 443 was required.
Anyone using rackspace will find this useful:
To allow secure traffic you would need an additional load balancer
allowing traffic on port 443, with a shared VIP with the current one.
https://support.rackspace.com/how-to/configure-a-load-balancer/
I am using aws instance, apache server and tomcat7 under apache.
I am able to hit my site with "http": http://www.example.com and everything is normal.
But when i am trying to hit the using "https" : https://www.example.com, i get Linux AMI test page. Is there any configuration i need to change in the httpd config file?
I have also tried : netstat -ptnl | grep ":443" and the response is :
tcp 0 0 :::443 :::* LISTEN 11722/httpd
My ELB listeners :
So, where am i going wrong?
From the ELB configuration you have shared it looks like you have configured ssl on the ELB.
Unless you intend to do ssl termination on the apache server, the issue should be re-solved by routing traffic from elb to instance over http.
After the reconfiguration, the config should look like
HTTPS 443 HTTP 80 Change <cert> ACM change
The ssl cert will be used for encrypting the req/response from clients to the ELB. From ELB to instance, the communication will be over http.
I have an instance listening on port 8080.
I want to create a load balancer to map 443 (ssl) to the instance port 8080 so that ssl terminates at the load balancer and traffic between the lb and the instance is not encrypted.
I have uploaded the ssl cert, created an HTTP load balancer but can't seem to figure out how to set up the forwarding like that.
Coming from AWS ELB, there's a simple way to do this, can't find a way to do it on Google Cloud Platform.
Any thoughts ?
Found it.
Create an instance group that has at least 1 live instance
Create http load balancer with the following:
Upload a SSL certificate
Create a backend service to point to the instance group. Make sure the protocol is HTTP
Create a target https proxy with the certificate you uploaded
Finally, create a global forwarding rule that points HTTPS to the target proxy you created before.
I have installed an SSL on ELB. I have one EC2 instance in the ELB and can access the website via the SSL fine (IIS Windows 2008 server).
The confusion is when I am in NON HTTPS and I perform a redirect in my app to the HTTPS area, I get an error.
Doing some digging in the listeners area, I can see Port 443 on the ELB forwards to port 80 on the instances which makes sense, but then how do I handle this scenario?
For now, I have 'hacked' it by adding a self signed cert on my instance and then forwarding 443 from ELB to 443 on the instance, but this kind of defies the point?!
Any advice on how this should be structured would be great!
You have both port 80 and 443 on you load balancer forwarding to port 80 on your instance, so you need to figure out how to tell them apart.
The ELB sets a header value so you can tell these two types of requests apart.
Take a look at http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/TerminologyandKeyConcepts.html#x-forwarded-headers but the value you want to check is X-Forwarded-Proto - this should have http or https, and obviously if it's http you would then redirect to https.