SendX, a provider of email marketing software, relies on AWS resources for our infrastructure. A critical aspect of our operations involves the dynamic generation of SSL certificates for our clients' domains, such as "sp-track.<client_url>," within the Nginx layer of our instances.
In our previous setup, we accomplished this by configuring a CNAME record for "sp-track.<client_url>," pointing it to our domain, "track.sptrackh.com." Requests directed to "track.sptrackh.com" were then routed to the IP addresses of our instances. Within these instances, requests like "https://sp-track.sx22.email/api/v1/track/click/7/34782/293/default/dc172479-9707-4680-bb21-6627ed6fd8f4?redirecturl=http%3A%2F%2Fsendx.io " triggered the generation of SSL certificates for "sp-track.sx22.email" at the Nginx layer.
Additionally, we implemented security measures at the Nginx layer to proactively combat phishing emails and spam email links.
Now, as we aim to integrate a load balancer into our infrastructure, we seek to shift the responsibility of blocking phishing emails and spam email links exclusively to the load balancer. However, it is imperative that we retain the capability to generate SSL certificates for our clients' domains, especially for cases like "sp-track.<client_url>," where SSL certificates are currently generated at the instance level.
In this endeavor, we would greatly appreciate the assistance and guidance of the AWS support team to help us implement this transition successfully. We are looking for expert suggestions and best practices to ensure that our SSL certificate generation remains intact while enhancing our security measures by offloading the task of blocking malicious emails and links to the load balancer. AWS support is a vital resource in helping us achieve this critical milestone in our infrastructure evolution.
AWS OFFICIALUpdated 2 years ago