0

I started setting up Amazon's ELB Service for my server. We have one nodejs server behind the ELB and 2 mongoDB Servers. I want to get SSL certificate for my domain api.mysite.com that A record with Alias to ELB Address (set in router53). I know that we must have static ip address for SSL certificate but the ELB address maybe change. so I want to know that:

  1. should I get elastic IP for my nodejs server?
  2. If I shutdown the nodejs server and change the IP of nodejs server, Is SSL still works or not? What should I do?
  3. Should I change my DNS Setting?

2 Answers 2

3

Certificates do not require a Static IP. They don't even require their own IP, this is only encouraged because about 15% of the Internet still doesn't support SNI.

Certificates only require that whatever the user enters in the URL is part of the the Subject Name (usually the Common Name, but it's a long story).

So you need:

  • A certificate that points to api.example.com
  • A DNS record that point api.example.com to an IP on your server (doesn't matter if it's ELB, Elastic IP, whatever you would type into your computer to hit your server).
  • A server responding to requests directed at that IP, which has the certificate's matching private key.
4
  • Is there source for the percentage quoted?
    – user
    Jul 1, 2013 at 13:58
  • @user Basically, the percentage without SNI support is the folks using IE on Windows XP.
    – ceejayoz
    Jul 1, 2013 at 14:16
  • 1
    WinXP is the biggest culprit lacking SNI Support (with IE or Chrome only; others work) and still holds about 20% market share as of writing. Many on XP do have Firefox or Safari, and XP users tend to "consume" Internet content less than those with newer OSes, so on the whole 15% is a good ballpark number. Every website is different of course, different users/target audience. A quick hard number, my blog saw 14 WinXP/IE browsers out of 1000 in the last quarter.
    – Chris S
    Jul 1, 2013 at 14:18
  • Yep completely agree. I just thought there might be a nice study/survey done on the matter, that quotes a percentage, that I've missed.
    – user
    Jul 1, 2013 at 14:21
0

I know that we must have static ip address for SSL certificate

No, you don't. Install the SSL on the ELB and you're good to go.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .