Amazon VPC ELB SSL port redirection

Question

I have an Elastic load balancer with 2 ports open, 80 and 443. 443 has SSL on it. both 80 and 443 are being redirectedt to internal servers port 80.

The issue is that i want to run my site only on port 443 (SSL Enabled) and never in plaintext. now i am not sure that how i would have to arrange the ELB and ports on server, so that when the reqest on port 80 comes, it redirects to port 443 always.

In the above case, there is a redirection look as i have put REWIRTE rule for redirect on 443 from 80 in apache.

Any solution for this?

Answer 1

There are 2 ways you can solve this.

1) Have apache serve up on both port 80 and port 443, with the ELB redirecting to those ports respectively.

2) Handle this at the application level. Make your application force https:// before rendering any pages.

Answer 2

From Amazon's forums.

Let me first state the problem you are trying to address to see if I got it right: you want all user traffic passing through the ELB and flowing to the EC2 instances to happen over HTTPS.

If that's the case, the short answer is yes but it will require some work on the AMI and the ELB.

1. Follow the steps highlighted in the docs on how to create a custom AMI.
2. Upload your SSL certificate to the instance.
3. Create a keystore file to store the private key and cert.
4. All requests to Tomcat are proxied through Apache. So I'll assume that you'll terminate the SSL connection at Apache. As a first step, install mod_ssl using:

yum install mod_ssl

5. Add a HTTPS listener to Apache on port 443.
6. Upload your web application's certificate to IAM. For more info, see this.
7. Add a listener to the ELB using the ELB command line.
8. Add a listener to the ELB that listens to traffic on port 443 and routes the traffic to port 443 on the instances using the cert that you uploaded to IAM.

(Optional) You can use certificate authentication to authenticate the traffic between the ELB and the EC2 instances. You'd need the public key of the cert that you're using in the EC2 instance's keystore.

Note: The above steps allow you to terminate SSL connections at the EC2 instances. It is not possible to completely shutdown port 80 on the instances as Elastic Beanstalk communicates with the Host Manager using that port. You can turn off port 80 on the ELB if you wish to do so.

source: HERE