WSS with Cloudfront

Question

Hello! I am interested in having an ESP32 send data via a secure websocket to a .js file in a S3 bucket hosted via CloudFront. To do this, I think I need a SSL certificate, which I believe is automatically generated when I create a default distribution ending in *cloudfront.net.  Where can I find this certificate? All the tutorials I've seen obtain this certificate is with a custom domain name, which I do not want right now since I am still testing. Will I be able to connect an ESP32 to CloudFront with this certificate?

re:Post Agent · Answer

You're on the right track with your understanding, but let me clarify a few points for you regarding using WebSockets with CloudFront and the SSL certificate situation.

First, CloudFront does support WebSocket connections, which is great for your use case with an ESP32 sending data to a .js file in an S3 bucket. WebSocket connections can use the same ports as regular HTTP traffic (80 for unsecured and 443 for secured connections).

Regarding the SSL certificate, you're correct that when you create a default CloudFront distribution with the *.cloudfront.net domain, CloudFront automatically provides and manages an SSL certificate for you. This is called the CloudFront default certificate. You don't need to find or manage this certificate yourself - it's handled entirely by AWS.

For your testing purposes with the default CloudFront domain, you don't need to obtain or configure any additional certificates. The CloudFront default certificate will work fine for secure WebSocket connections (WSS) to your distribution's domain (something like d111111abcdef8.cloudfront.net).

To use secure WebSockets (WSS) with your CloudFront distribution:

1. Ensure your distribution's "Viewer Protocol Policy" is set to either "Redirect HTTP to HTTPS" or "HTTPS Only" for the relevant cache behavior.
2. Use the "wss://" protocol in your connection URL from the ESP32, followed by your CloudFront distribution's domain name.

You should be able to connect your ESP32 to CloudFront using this setup without needing a custom domain or additional certificate. The CloudFront default certificate will be used to establish the secure connection.

Remember to properly configure your distribution to forward the necessary WebSocket-related headers to your origin (S3 in this case). You might want to use the "AllViewer" managed origin request policy or create a custom policy that includes the "Sec-WebSocket-Key" and "Sec-WebSocket-Version" headers.

This setup should allow you to test your secure WebSocket connection from your ESP32 to your CloudFront-distributed S3 content without the need for a custom domain or additional certificate management.  
**Sources**  
[Use WebSockets with CloudFront distributions - Amazon CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.websockets.html)  
[Require HTTPS for communication between viewers and CloudFront - Amazon CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html)  
[AwsCloudFrontDistributionViewerCertificate - AWS Security Hub](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsCloudFrontDistributionViewerCertificate.html)

WSS with Cloudfront

Add your answer

Relevant content