EC2, IP Addresses, Domain Name, SSL, and Instances Worry.

Question

I'm currently using my EC2 Instance to host a program but my instance needs a domain name to have a SSL Certificate given by AWS. However, I'm worried that in the future when I need my instance to be upgraded its ip address will have to change if I choose to upgrade. What will happen to my SSL certificate then? Would that mean for my new Instance I have to get it re-certified, which also means I have to buy a new domain name? Or could I re-use my domain name to my new Instance? And if I do re-use my domain name, will that still provide me the SSL Certificate for my Instance to have a HTTPS in its link?

My biggest concern here is cost, I'd like to keep it minimal. So I'm worried if I have to get a new domain name for every time I want to upgrade my instance, because I'm not clear if upgrading my instance will change its ip address that is linked to a domain name certified with a SSL. I'm also not clear if upgrading my instance will change its ip address associated with the certified domain.

My priority is just making sure that I have sufficient amount of resource in my instance to run the program and a HTTPS Link to have security for my clients.

Answer

IP addresses are not linked to SSL certificates in any way. In one technical sense, a certificate is a text file that contains a private key (and probably public) key. As long as your instance has that file (and we strongly recommend that you update the certificate periodically - it has an expiry date) then it is able to host HTTPS session.

There are many ways to get a properly signed certificate - all of them will have some way of ensuring that you own the domain that you are generating the certificate for. So as long as you can do that (which might be via DNS entries or via email) then you can continue to generate certificates.

You do not need a new domain name when you upgrade your instance.

Answer

Everything @Brettski says in his answer is correct, addressing a few more points from your question:

You mention you need an SSL certificate given by AWS - if you're just running a single EC2 instance, without CloudFront or a load balancer in front of it, then AWS can't issue a certificate for that. Amazon Certificate Manager (ACM) issues certificates for use with selected services like CloudFront, load balancers, API Gateway, and others, but not EC2 https://docs.aws.amazon.com/acm/latest/userguide/acm-services.html

Say you own **mydomain.com**, you probably want to create an A-record whose name is **mydomain.com** and value is the public IP address of the EC2 instance. You may also want to create a record for **www.mydomain.com** as well, up to you. The public IP address will change if the instance is stopped and started (but not if it is rebooted) and the record would need to be updated if this happens, as would also need to happen if the instance was terminated and replaced with a new one.

To generate a cert to be used with EC2 you'll need to use a third party such as LetsEncrypt https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/SSL-on-amazon-linux-2.html

The certificate signing request (CSR) should include **mydomain.com** and perhaps **www.mydomain.com**, or even just the wildcard ***.mydomain.com** depending on your particular use case. The certificate request doesn't need to have the IP address.

If you've put CloudFront or a load balancer in front of your EC2 then you can get a cert from ACM and associate it with that service, and you won't now need a cert on your EC2. Assuming your domain is purchased and managed through Route 53 the certificate can be validated more-or-less automatically using Route 53 to prove you own the domain. Again, the certificate should only include DNS names, not IP addresses.

Your Route 53 records for **mydomain.com** and so on would point to the load balancer or CloudFront distribution, and unlike in the EC2's case these should remain static.

EC2, IP Addresses, Domain Name, SSL, and Instances Worry.

Relevant content