2

I have completely ran out of ideas to fix this issue. I've gone through just about every given solution to similar issues and nothing has worked successfully.

I've successfully set up my Ruby on Rails application using Elastic Beanstalk to work over HTTPS. The url provided for my elastic beanstalk application is working correctly - which means my SSL cert is correct.

I have two hosted zones for my registered domain which I tried to route to my elastic beanstalk URL using CNAMEs, but that doesn't do what I want since www.something.example.com will work, but www.example.com won't - which is pointless.

I originally used A records for each hosted zone and set them to the Elastic IP address associated with my Ec2 instance. The problem with this though, is that my public DNS url does NOT work when configured for HTTPS. I get an "ERR_CONNECTION_REFUSED" every time I try to connect to either the elastic IP or the given Ec2 public DNS.

Here are the Load Balancing settings for my Elastic Beanstalk app:

Here is the security group info from my Load Balancer description:

Here are the set rules for that security group:

Here is the view from the instance showing the set rules:

Here are the listener settings from the load balancer:

I used this solution to set the listener settings.

I used this solution to set the inbound settings for the security group.

I have "config.force_ssl = true" in my production.rb file. I can not access the site using HTTP, all traffic is rerouted automatically to HTTPS.

To recap:

  • Elastic Beanstalk env URL - working correctly (HTTPS)
  • Ec2 Instance public DNS - NOT working (HTTPS)
  • Elastic IP - NOT working (HTTPS)

Thank you to anyone that can provide insight as to what's going on.

EDIT

Fixed. See checked solution.

  • 1
    You will likely have to post some specific information here to get help. Even if you have to use substituted names, can you add information for the hostname(s) that work vs the ones that dont, and using the same scheme, post the dns names for the ssl cert? This sounds to me like a DNS/cert issue but I need more details to be sure. – Chad Smith Apr 22 '15 at 23:47
  • you talk about HTTPS not working on EC2/EIP and then working on Beanstalk, but then you show images from an ELB, which shows the connected instances only need to speak HTTP since it's handling the SSL. In any case, your assumptions with a CNAME are incorrect. But there's too much to weave through here (and yet a lot of info missing) to provide a single answer. – tedder42 Apr 23 '15 at 0:01
  • See my solution. You don't have to worry about the EC2 EIP at all to make this work. – Chad Smith Apr 23 '15 at 2:21
4

Solution: (assumes your dns for example.com is in route53): Create an A record for the apex of example.com (no hostname), and select YES for alias.

For the Alias Target, use the ELB entry point for elastic beanstalk (there should be a drop-down list you can choose from.

After the dns record propagates, you can reach the site correctly via https://example.com (I tested this via an /etc/hosts entry).

If you do not have example.com in route53 (or cannot get it there), you will be forced to create a different SSL certificate, because it the current one is only usable on the apex of your site. A wildcard certificate for *.example.com would give you much more flexibility in site names in DNS.

  • Awesome. Thank you. Unfortunately I don't have a wildcard SSL yet. I'm assuming this means I can't access "www" until I do so. That's okay at this point, I'm using the free 90 day SSL at the moment. – user3386826 Apr 23 '15 at 2:48
  • AWS ACM (free) Certs will allow for *.example.com wildcards and you can add example.com to it as well. Then you can select it from a dropdown when creating an A record that is set to Alias: Yes. – Jordan Aug 26 '17 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.