What I want is that all the communication between my ELBs and the external world should be over HTTPS. How can I achieve this ?
Completely disabling plain HTTP is usually not on option, but can configure your webservers to (permanently) redirect any unencrypted request from
Can I install the one wild card certificate that I have on all the three ELBs?
There is no technical reason why you couldn't.
Also since it is a wild card certificate that I have, I would not be able to use it for
api.example.com but not for
example.com itself (as per my understanding).
However, what is visible to the external world is
example.com for now (and not really
api.example.com) So do I need to purchase another certificate for the above scenario ?
Yes a wild-card for
*.example.com is only valid for
<valid_hostnames>.example.com and neither for plain/naked
*.*.example.com will work. See this Q&A for the details.
Technically it's possible to also include the plain domain with the wildcard certificate via a Subject Alternative Name extension, making the certificate valid for both
example.com but which SSL resellers do that automatically I don't know. So you may not need another (replacement) certificate at all.
You can check with
openssl x509 -in certificate.crt -text -noout which will yield something similar to when SubjectAltNames are present:
Version: 3 (0x2)
Subject: ..., CN=*.example.com
X509v3 Subject Alternative Name:
If that is not the case you may need another certificate to be able to use the bare domain in addition to your current wildcard. Server Name Indication (SNI) is what would be required to use two different SSL certificates and have them to work correctly on a single ELB instance.
Unfortunately as stated in the Elastic Load Balancing product documentation with regards to HTTPS:
Elastic Load Balancing does not support Server Name Indication (SNI) on your load balancer.
So two certificates on one ELB is a no-go.
Which type of certificate (I read about UCC SSL Certs here)should I go with, given that I also have
example.in as a domain as well where the same site is hosted.
The ELB product documentation gives two strategies:
Buy a single multi-domain certificate with Subject Alternative Name (SAN) for each additional domain (sometimes called a Unified Communications Certificate (UCC) rather than SAN Certificate) and use that on the ELB.
Use TCP listeners on port 443 for the front-end and back-end connections. The load balancer passes the request through and you handle the HTTPS termination from the EC2 instance, with a webserver that does support SNI.