How do I set up SSL to my ec2 instance via a load balancer?

Question

I have a certificate issued by Amazon Certificate Manager, I set up a load balance and selected the certificate I was issue, and then pointed it to the ec2 instance I am running, and added a listener for port 443, checked that the security group has input rules set up for that post/protocol.

Then I got the IP for the load balancer and pointed my domain to that.  Now I am able to to my domain on port 80, but when I do https://mydomain.com it just sits there and never connects.  I'm not sure where to go from here?

Riku_Kobayashi · Answer

Hello.

Has the certificate issued by ACL been verified?  
If verification has not been completed, please follow the steps in the document below.  
https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html

Also, could you please share what kind of error occurs when connecting with the curl command as shown below?

```
curl https://example.com -v
```

Gary Mclean · Answer

The IP addresses of your ALB are
18.116.132.9
18.189.254.253

I can connect to the ALB via HTTPS and it has a valid certificate attached to it but your right, Https isnt connecting to the Back end.

I do get a HTTP408 error which indicates a timeout

The HTTP 408 Request Timeout error is a client error that indicates the server has terminated a connection because a request from the client took too long. This can happen for a number of reasons, including: A slow server response time, Network connectivity issues, and An old or incorrect URL.

Please check ACLs, Security Groups and target groups are reporting healthy
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html#add-https-listener

Steve_M · Answer

Your domain **cygnusx.com** resolves to an EC2 instance, not the load balancer (do a lookup on it, then a reverse lookup on the IP):
```
$ nslookup cygnusx.com
Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
Name:	cygnusx.com
Address: 18.220.224.215

$ nslookup 18.220.224.215
215.224.220.18.in-addr.arpa	name = ec2-18-220-224-215.us-east-2.compute.amazonaws.com.

Authoritative answers can be found from:

$
```
www.cygnusx.com is the same as cygnusx.com.

These need to point at the load balancer, not the EC2 instance behind it (and point it to the name instead of one of the IPs).
```
$ nslookup Main-Load-Balancer-621906210.us-east-2.elb.amazonaws.com
Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
Name:	Main-Load-Balancer-621906210.us-east-2.elb.amazonaws.com
Address: 18.189.254.253
Name:	Main-Load-Balancer-621906210.us-east-2.elb.amazonaws.com
Address: 18.116.132.9
$
```
So now a browser trying to hit **cygnusx.com** should hit a load balancer presenting the ACM cert for **cygnusx.com**.

Make sure the security group on the load balancer accepts inbound TCP ports 80 & 443 from 0.0.0.0/0, and then outbound port 80 only to the back-end EC2 instance (assuming you want the load balancer to do the SSL offloading for you). Make sure the back-end EC2 instance security group has got inbound TCP port 80 open from the load balancer's private IPs, and the web server (Apache or nginx or whatever) is setup to only listen for HTTP on port 80.

To setup HTTP to HTTPS redirect on the load balancer, the steps are here https://repost.aws/knowledge-center/elb-redirect-http-to-https-using-alb

SideFX · Answer

Also wanted to add I changed the DNS in my local hosts file so that life DNS isn't currently updated.

How do I set up SSL to my ec2 instance via a load balancer?

Add your answer

Relevant content