How can I redirect HTTP requests to HTTPS using an Application Load Balancer for an application on port 3000?

Question

Hello all,
     I have a nodejs /react app on EC2 linux. I do not want to add any additional web products.
I created an ALB with a Target Group that contains the instance running my application. I have installed my SSL certificate and have it in the AWS Certificate manager.  
When I go to my ALB and plug in my DNS name info into a browser, the site comes up, but it says "Insecure", certificate is not valid.
I have a *.MyDomain.com cert because I am using this cert for a sub domain that houses my application. 
My target group is healthy. My listeners appear to be correct. If I go to the HTTP address :3000 the site wors as expected, and I get the Not Secure message. If I go to HTTPS address I just get a "Site can't be reached" message.  Any ideas and or suggestions on how to get the HTTPS working with the cert for an app that runs on port 3000? Thanks in advance.

Accepted Answer

> I go to the HTTP address :3000 the site wors as expected .... how to get the HTTPS working with the cert for an app that runs on port 3000?

You can't have HTTP and HTTPS listening on the same port, only one or the other.

Have I undertood this correctly, at the back end you have an EC2 instance with your app listening on HTTP on port 3000?

I think the way to do this is to have the load balancer listening on port 80 (HTTP) and 443 (HTTPS), with a listener rule that redirects 80 to 443 https://repost.aws/knowledge-center/elb-redirect-http-to-https-using-alb

And a listener on port 443 which forwards to the target group on port 3000.

This way, you hit http://[your_ALB]/ (port 80 implied) and it redirects to https://[your_ALB]/ (port 443 implied) where the connection is validated using the cert you got from AWS Certificate Manager. From there it goes on to http://[your_EC2]:3000/

Hit https://[your_ALB]/ (port 443 implied) from a browser and it's the same, just without the initial redirect.

The ALB will need a security group allowing 80/tcp & 443/tcp inbound from 0.0.0.0/0, and 3000/tcp outbound to the EC2. The EC2 instance will need a security group rule allowing 3000/tcp from the ALB.

If you want, you could have another listener on port 3000 (you decide whether this is HTTP or HTTPS) which redirects to port 443 as well, just like port 80 alrewady does. If you choose to do this, add another ALB inbound rule on 3000/tcp.

Answer

Hello.  
Do you want to use port 3000 for HTTPS access?  
Or do you mean that you want to access HTTPS:443 when accessed via HTTP:3000?

First, if you want to access with HTTPS:3000, I think you can solve this problem by setting the port number of the ALB HTTPS to 3000 in the listener rule.  
At that time, HTTP access must be a number other than 3000.  
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html

Next, we will explain how to access the site with HTTP:3000 and redirect to HTTPS:443.  
This one creates a listener rule for HTTP:3000.  
By setting a rule to redirect to HTTPS in the listener rule, HTTPS:443 will be accessed.

Incidentally, the ALB security group should be set to allow the necessary TCP ports.

How can I redirect HTTP requests to HTTPS using an Application Load Balancer for an application on port 3000?

Relevant content