THE SETUP
We have a webs/wix/etc-like website management system we are trying to use with CloudFront. It has the following domains and subdomains.
- ourdomain: our main website
- admin.ourdomain: the administration interface for every website, available through https
- images.ourdomain: an S3 bucket
- router.ourdomain: see below
- [customersomething].ourdomain: the subdomains for our free users
- [customersomething.com]: domains for our premium customers
The system works in a way, where most of the domains are CNAME-d to router.ourdomain (because that was the easiest way for our customers with their different domain-registrars and such) and the router.ourdomain is A-aliased to our ELB, and then the PHP on our EC2-s are handling the sites based on the HTTP_HOST values, whilehe images coming from S3.
OUR PLAN
And now we want to put this whole stuff behind a CloudFront. Most of the stuff is trivial. It was easy to put the S3 behind CF. It was easy to put every ourdomain/*.(js|css) behind CF through an asset.ourdomain subdomain. It is a joy that we can use *.images.ourdomain to shard between subdomains on the fly decreasing clientside loadtime etc etc. We even could put every *.ourdomain stuff including the dyanamic PHP free sites behind CF by putting "*.ourdomain" into the CF params.
THE PROBLEM
But the one thing we can't figure out is how to put the all the dynamically created PHP sites with custom domains behind CF. As a reminder: these are CNAME-d to router.ourdomain. Putting each domain into the CF params is not an option, as we need to be able to handle tens of thousands domain names, and we need to do that without manual configuration for each of them.
So our thought was that we should put router.ourdomain into the CF configuration as alternate domain name, point the router.ourdomain to the CF in route 53, and point the CF to our ELB as origin. Which we found out is a nice way to get this message every time: "ERROR The request could not be satisfied. Bad request. Generated by cloudfront (CloudFront)". Actually not every time, as the www.ourdomain works as it should (it is CNAMEd to router.ourdomain), but every other subdomain gives the error above (*.ourdomain is CNAMEd to router.ourdomain, but it goes the same for even those subdomains that are CNAMEd to router.ourdomain one by one, except the www, and of course the router). So right now we not just don't have any idea how should we solve this, we don't even understand, why does it work for the www if it doesn't work for every other or vice versa.
Any thoughts and ideas would be appreciated, thanks.