Load Balancer, EC2 - HTTPS Connection

Question

Ok this might be a rookie question but here's my scenario.

1. I have a loadbalancer managing a single EC2 instance at the moment.
2. I have an application running on that EC2 instance.

What I like to achieve: 1. A complete HTTPS only connection to my application on EC2 that presently binds to 8080.

Whats the right way to achieve it? 1. Should I just upload a SSL certificate to the loadbalancer and force an SSL connection between just the client and the load balancer? Should I let the traffic between load balancer & EC2 be protected by security group?

OR--

2. Do I need to configure my tomcat web app server with another certificate and configure its 443 https connector with keystore path and redirect HTTP connections to 443 port?

OR--

Is there something that I am missing Thanks,

Answer 1

The simplest configuration for your needs could be:

1. Set your tomcat to listen on port 8080 as HTTP
2. Upload your SSL certificate to ELB and set your ELB to terminate the SSL.
3. Forward port 443 on ELB to port 8080 on your instance.
4. Configure your EC2 security group to only accept connections from the ELB's security group on port 8080. This way, no one can circumvent your ELB.

This will offload the encryption from your EC2 instance to the ELB.

Optional extra:

4. Also forward HTTP port 80 on ELB to another port on tomcat and redirect HTTP to HTTPS.

This way, if your client connects by HTTP, they will redirect to HTTPS automatically.

Answer 2

Usually your load balancer will handle negotiating https connections to your clients, then it will connect back to the origin tomcat server(s) to get the content over plain http (since there's not too much need to encrypt for that short hop, and presumably you can trust the local network). You should set your load balancer to redirect any http requests it receives to https, and you'll only need to set up the https certificate on the load balancer. For the tomcat back ends, you'll need to make sure all links are either relative, or tell the client to go to https.

I'm not 100% sure if this is what you were after, so let me know if there's something different you wanted to know.

Answer 3

I think the accepted answer is not correct. Uploading your SSL certificate to the load balancer and asking for a HTTPS channel will cause the loadbalancer to decrypt the SSL traffic and pass it in decrypted behind the loadbalancer. (The OP asked for SSL to the application).

According to the ELB docs

"If you don't want the load balancer to handle the SSL termination (known as SSL offloading), you can use TCP for both the front-end and back-end connections, and deploy certificates on the registered instances handling requests."

So, the right thing to do he would be to forward TCP:443 (at the load balancer) --> TCP:443 (at the instance, or some other port).

If you want end-to-end encryption, you must then install the SSL keys on the application server.

This will also mean that ELB can't fiddle with your HTTPS headers -- which I think is needed for sticky connections. For stateless application servers, this is a non-issue.