Cannot reach instance via HTTPS

0

Hi,

i'm experiencing a problem with the HTTPS setup

There is a EC2 instance in the "us-east-1c", which at the moment have nginx in Docker container and is responding to the requests via http :80 (no SSL setup in Nginx)

To be able to communicate via HTTPS i've set up a Load Balancer with the following details:

Load balancer type Application Scheme Internet-facing Availability Zones: subnet-0a5ea626d1b3eea1d us-east-1b (use1-az2) subnet-022fe15b2fc4b19dd us-east-1c (use1-az4)

The Load balancer is "active", as it can be seen in the Load Balancers console.

There is one listener: HTTPS:443 which is connected to the previously issued certificate in the certificate manager.

The listener is forwarding requests to the Target Group in the same VPC, zone us-east-1c. This only contains one instance (mentioned in the beginning of this message), and in the Target Groups console it's status is "healthy"

The Security Group for this Load Balancer contain inbound rules for 80 and 443 for both IPv4 and v6

Still, when i'm trying to connect to my instance via https, i.e.:

curl -I 'https://<domain-name>/'

i'm getting "curl: (7) Failed to connect to <domain-name> port 443 after 163 ms: Couldn't connect to server"

while access via HTTP works just fine, i.e.:

curl -I 'http://<domain-name>/'

responds with the following:

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 15:11:33 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1159
Connection: keep-alive
X-Frame-Options: DENY
Vary: origin
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Cross-Origin-Opener-Policy: same-origin

Please, can you help me - what am I doing wrong?

Target group

Listeners

Listener: details

Enter image description here

Thanks in advance!

  • Hello. Could you please send a screenshot with the target group configuration and Listeners configuration?

    Best regards, Andrii

  • @Andrii S - updated the question

asked 7 months ago194 views
1 Answer
1
Accepted Answer

Hello.

Is the domain "https://<domain-name>/" correct for accessing ALB?
Have you linked your domain to EC2 by mistake?

Did you update your domain after adding the ALB?
As you can see in the image, there is only 443 in the listener rule, so access on port 80 should fail.

profile picture
EXPERT
answered 7 months ago
profile pictureAWS
EXPERT
reviewed 7 months ago
  • The domain is correct and the certificate obtained for it is valid.

    Not sure i understand this: "Have you linked your domain to EC2 by mistake?" - since the webserver gives me correct responses via 80, the domain setup should be correct, isn't it?

  • Adding HTTP:80 to the rules didn't help...

  • Could you please share an image of your ALB security group?

  • @Riku_Kobayashi re: screenshot - updated the question

  • When I run the nslookup command, a different IP address is returned. What kind of domain settings do you have?

    nslookup webserver-531843639.us-east-1.elb.amazonaws.com
    Server:         192.168.11.1
    Address:        192.168.11.1#53
    
    Non-authoritative answer:
    Name:   webserver-531843639.us-east-1.elb.amazonaws.com
    Address: 34.231.232.72
    Name:   webserver-531843639.us-east-1.elb.amazonaws.com
    Address: 52.20.15.22
    
    nslookup staging.memory-lane.ai
    Server:         192.168.11.1
    Address:        192.168.11.1#53
    
    Non-authoritative answer:
    Name:   staging.memory-lane.ai
    Address: 54.160.251.252
    

    If zone has just been updated, there may be some cache remaining due to TTL.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions