Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 4 down vote favorite
6

we're thinking of getting an application hosted on the ec2 service, and the application's documentation says that an SSL certificate can be installed for secure communication (https).

Its not clear to me whether a site hosted there can have one installed.

share|improve this question

3 Answers

up vote 7 down vote accepted

SSL certificates specify a domain name or names, not an IP address. I have not used an SSL certificate on an EC2 host, but I don't see why it wouldn't be possible.

You will probably want to use Amazon's Elastic IP service so that you can maintain a stable relationship between a given EC2 instance (EBS-backed, I imagine) and the publicly visible hostname; the hostname is what's described in the certificate.

Obviously, installing the private key for an SSL keypair on someone else's hardware has security implications - but I bet that the majority of SSL private keys are sitting on hardware that's not owned by the holder of the certificate, so it's not like that's an unfamiliar or unusual risk.

Low-end certificates aren't very expensive these days - most of the certificate vendors will even issue you a temporary 30-day cert for free so you can experiment with it and see how it will work out in your environment. You can also use a self-signed certificate which will probably generate complaints from browsers.

share|improve this answer
But why it is that some webhosting services force you to buy an IP address if you want to have an SSL certificate installed on your domain? – TWord Jul 29 '10 at 12:14
Non-SSL virtual hosts work by including a "Host:" header in the HTTP request that tells the server what (virtual) host the request is intended for. This means that many domains can be handled on a single IP address; the server figures out how to respond by looking at the Host: header. The traditional setup for SSL connections meant that it was necessary to negotiate the cryptographic aspects of the communication before the HTTP request could be presented to the host. This meant that the only way to differentiate between requests for the same server was to use one IP address per virtual host. – gbroiles Jul 30 '10 at 1:59
So are you saying that one IP address IS required for an SSL certificate? The way I understand the Amazon system is that its all just one big virtual hosting provider - I know that a dedicated IP is NOT possible at Amazon, so by the above the SSL cert shouldn't work as well...? – TWord Jul 30 '10 at 4:53
A dedicated IP is possible with EC2, that's what Elastic IP does. The IP address you get with an EC2 server (non-Elastic IP) is not shared with others at the time that you're using it, but will be reused after your EC2 instance is deleted. – gbroiles Jul 30 '10 at 7:36
1  
So a fixed/static/dedicated IP address is NOT required... – TWord Jul 30 '10 at 13:23
show 1 more comment
up vote 5 down vote

Further to @gbroiles' answer above, I'm running a site for my company which is hosted on EC2 and has an SSL certificate. EC2 gives you full access to the operating system, so I just installed the certificate in our Apache server in exactly the same way as if it was running on a physical machine.

We use an elastic IP address as described above; Amazon doesn't charge for elastic IP's if they are in use, but there is a small charge for unused elastic IP addresses. See the AWS pricing page for more details.

share|improve this answer
Thanks for your input gareth - having someone doing exactly that is very reassuring! – TWord Aug 4 '10 at 10:54
up vote 0 down vote

Yes you can use it - Amazon's EC2 hosting provides an "elastic IP" which is a dedicated IP address for as long as you need it. If you no longer need it, I'm assuming you no longer need the SSL cert!

Installation won't be as easy as through a GUI on Plesk or CPanel etc, but it's pretty straightforward via your terminal - in fact, when you purchase an SSL Certificate, they usually run through the instructions on their website for installation on linux or whatever.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.