Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need a static IP address that handles SSL traffic from a known source (a partner). The reason the IP needs to be static is that the partner requires this in order to maintain the PCI compliance.

Our servers are behind an AWS Elastic Load Balancer (ELB), which cannot provide a static IP address; many threads about this here.

My thought is to create an instance in EC2 whose sole purpose in life is to be a reverse proxy server having it's own IP address; accepting HTTPS requests and forwarding them to the load balancer.

Are there better solutions?

share|improve this question
1  
What's wrong with using the ELB DNS Name instead of IP? –  Jason Floyd Sep 27 '12 at 22:35
    
I apologize -- I failed to explain why I need to jump through this hoop of getting a static IP address. I have clarified my question. –  Tom Harrison Jr Oct 1 '12 at 13:57
    
That's the first I've heard of a static IP address being required for anything related to PCI. Besides, even "static" IP addresses change from time to time. –  Michael Hampton Oct 1 '12 at 14:03
    
It's the first I have heard of it, too, but this is the kind of partner who says "jump" and we ask "how high" :-). When I say "static IP" I mean an IP address (or range) that is assigned to my organization and will be ours until we decide to relinquish it. ISPs and larger companies may request a grant for a block of IPs issued by a government authority (IANA). This ensures that the IP address is unchanged as long as everyone holds up their end of the deal. Amazon's Elastic IP's also meet this criteria for "static IP", despite the implication of their name. –  Tom Harrison Jr Oct 2 '12 at 14:34

2 Answers 2

You don't need a "static" IP address to implement SSL; you do need a name in the DNS, for which the SSL certificate will be issued.

The typical solution to this is to create a name in the DNS and then make it a CNAME for the DNS name given for the Elastic Load Balancer.

share|improve this answer
    
@Micheal-Hampton -- I am sorry; I failed to explain why I need a static IP. I have clarified my question by adding the second sentence: static IP (or known IP range) is needed to satisfy the partner who maintains PCI compliance. Yeah, getting it to work off ELB along was no problem :-) –  Tom Harrison Jr Oct 1 '12 at 13:59
up vote 1 down vote accepted

In the end, I implemented the requirement of our partner as follows:

  • launch an instance in AWS
  • allocate and attach an Elastic IP (EIP) to it
  • Installed Apache
  • (in our case, installed our SSL certificate)
  • Configured Apache as a reverse proxy server, forwarding to a CNAME that pointed to our ELB

Here's a sample Apache virtual host configuration. I turned off NameVirtualHost and specified the address of our EIP. I also disabled a default host. If the partner desires, I will add a <Directory> block that accepts requests only from their IP range.

<IfModule mod_ssl.c>
# Catch non-SSL requests and redirect to SSL
<VirtualHost 12.34.567.890:80>
  ServerName our-static-ip-a-record.example.com
  Redirect / https://our-elb-cname.example.com       
</VirtualHost>
# Handle SSL requests on the static IP
<VirtualHost 12.34.567.890:443>
  ServerAdmin monitor@example.com
  ServerName our-static-ip-a-record.example.com

  # SSL Configuration
  SSLEngine on
  SSLProxyEngine on
  SSLProxyCACertificateFile /etc/apache2/ssl/gd_bundle.crt
  SSLCertificateFile    /etc/apache2/ssl/example.com.crt    
  SSLCertificateKeyFile /etc/apache2/ssl/private.key
  # Additional defaults, e.g. ciphers, defined in apache's ssl.conf

  # Where the magic happens
  ProxyPass / https://our-elb-cname.example.com/
  ProxyPassReverse / https://our-elb-cname.example.com/

  # Might want this on; sets X-Forwarded-For and other useful headers
  ProxyVia off

  # This came from an example I found online, handles broken connections from IE
  BrowserMatch "MSIE [2-6]" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0
  # MSIE 7 and newer should be able to use keepalive
  BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>
</IfModule>

Hope this saves someone else some time in the future :-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.