3

You will see a lot of places on the web telling you the way to setup SSL with an AWS ELB is to set up a certificate on the load balancer and then forward traffic from port 443 to 80 so that traffic between the load balancer and nginx is unencrypted. To me this doesn't appear very secure as you have unencrypted data flowing over a network connection. What if that data is credit card information?

My questions:

  1. Does having and unencrypted connection between the load balancer and nginx pose a security risk?
  2. If the answer to 1 is yes, how would I setup nginx to allow the secure connections from the load balancer?
  3. Would this involve setting up an ssl certificate on each nginx server?
  4. What would the nginx config look like if it needs to be different than a standard ssl setup where nginx is not behind a load balancer?
5

Does having and unencrypted connection between the load balancer and nginx pose a security risk?

  • If talking about credit card data and stuff like this: Yes.

If the answer to 1 is yes, how would I setup nginx to allow the secure connections from the load balancer? Would this involve setting up an ssl certificate on each nginx server?

  • The nginx config is / would be fairly standard, nothing fancy.
  • Yes, you would need a ssl certificate on each machine running nginx. You could use one cert for this, you don't need necessarily multiple. Besides: Using Lets Encrypt it's now fairly easy and automated possible to get certs, free of charge.
  • If you send sensitive data between the ELB and your machines, make sure this / these link(s) is encrypted as well. How to do this is explained in the docs.

What would the nginx config look like if it needs to be different than a standard ssl setup where nginx is not behind a load balancer?

  • There isn't a major difference, as far as I know. If you need the client IP for whatever reason, put these lines into your nginx config:

    real_ip_header X-Forwarded-For;
    set_real_ip_from ${ip-of-your-elb}/${netmask-of-your-elb};
    


  • Bonus: Set up your "own ELB", using the great HAProxy for example. Going this way, you could take care of the encryption between the ELB and the backend machines yourself, using whatever seems / is appropriate: https, ssh tunnels, a VPN, ...
5
  • The trouble with HAProxy is that it doesn't provide a high availability system like ELB does. You would need to setup multiple HAProxy servers and round robin DNS to achieve something similar but even then it wouldn't be as robust a setup – JamieD Jul 5 '16 at 10:13
  • @JamieD DNS isn't made for high availability, so I wouldn't recommend to use DNS round-robin if you're after HA. You could use a virtual IP, two (or more) instances, and software which does health checks and IP failover. See this answer as well. Been there, done (and doing) that. Regarding "[...] but even then it wouldn't be as robust a setup": I strongly doubt this. Many big websites / services (like StackExchange for example) use these kinds of setups, but anyway, ... – gf_ Jul 5 '16 at 15:29
  • ... this is of course up to you. – gf_ Jul 5 '16 at 15:29
  • im not saying you cant achieve a HA setup using something like HAProxy, but why (if you're already using AWS) would you goto the trouble of rolling your own system when ELB works very well and is likely to be a much better system than most people are capable of creating themselves? – JamieD Jul 6 '16 at 18:33
  • @JamieD Well, because as I described in my answer, you're then able to implement all the stuff you would like to. And yeah, you're right, setting up a system like this isn't that easy. – gf_ Jul 6 '16 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.