14

I have just hopped over to Amazon for serving my .net sites and one site requires SSL.

I have an elastic IP pointing at my EC2 instance, and I have my site setup in IIS 7 all working fine. I also have an SSL cert from a vendor. I have installed the SSL cert in IIS but my https connection will not display my webpage.

I think it is something to do with the fact that I dont have a dedicated IP address for the cert/website in question.

Can anyone give me any hints please?

2 Answers 2

16

In your EC2 control panel, look at your instance and note the Security Group that is assigned to it. Then, navigate to the Security Groups section in the control panel, open your group, and make sure that port 443 is allowed over TCP.

This must be open to allow SSL traffic to your instance. A simple way to check if the port is open to the outside is to telnet into your server's IP on port 443, and see if you can connect and get a response.

telnet yourhost.com 443
4
  • Ok checking now... :)
    – Anthony
    Aug 27, 2010 at 13:39
  • Fantastic its working now I have added 443 to the security group. Such an easy solution (for once).
    – Anthony
    Aug 27, 2010 at 13:56
  • 3
    +1 I would give you 300 up votes if could. I've been banging my head against this for four hours now.. Apr 20, 2012 at 2:07
  • Any solutions for the case where this doesn't change behavior?
    – BigMistake
    Oct 18, 2023 at 4:18
1

There really are only 3 parts to a SSL cert being used. It's usually easiest to check every step.

1) Make sure your apache config (or IIS/whaever) is correct. Did you correctly setup the SSL in the config? Are you being presented with a certificate at all? Or are you completely unable to connect to port 443 on that machine?

2) Make sure you're using the correct certificates. It's not hard to mix up the private key and public key with each other, or with a self-signed cert. Apache will throw an error if you mix the private & public keys... but none with self-signed certs. If you're able to connect to the site and are presented with the wrong cert, it's a good indication that your site is simple misconfigured with the wrong certs & you need to switch them with the correct public & private keys.

3) Certificate validity. Make sure the certificate is valid. Valid includes a few simple checks. #1: Is it expired? I've actually run into a glitch with one vendor who issued a certificate that was already expired. #2: does the subject name match the URL? Getting a cert for https://www.domain.com and browsing to https://domain.com won't work. #3: is really an appendage to #2... If you got a wildcard domain, you still have to match the domain suffix. i.e. *.domain.com won't match for *.domain2.com.

You must log in to answer this question.