Our domain is registered with GoDaddy and hosted on AWS.

in GoDaddy we have CNAME entry for www -> mylb_abc.... (AWS Load Balancer address).

Also, the domain is forwarded to http://www.domain.com in GoDaddy with permanent redirect(301).

Accessing website using following address in browser works fine. http ://domain.com https ://www.domain.com

However, when I type https://domain.com in browser it gives connection timed out error.

I have Apache on AWS. I read through various posts on internet that describes SSL certificate error due to missing wild card certificate but could not find any posting with this topic. Can you pls provide any pointers you may have.

Appreciate any help!

Thanks, Awsway

  • 3
    Share the real domain name with us so we can take a look. – ceejayoz Feb 19 '17 at 22:54

DNS Specifications state that the 'root' domain, ie "domain.com" cannot be a cname (or at least not with a standard setup).

Some hosts will allow you to configure it as such, but your 'mileage will vary', as DNS relays, caches, and clients shouldn't be expected to support it. (The reason for this is that cnames work for all record types, and you will want additional records at the root domain: MX, NS, etc)

Some DNS providers knowing that this is a 'common request', have a few workarounds, such as hosting a redirection service (you set the root domain to a set IP, and they handle the redirect), or offering 'forwarding' (effectivly the same thing). These generally don't work for HTTPS though as it would require a valid SSL Cert on the redirection server, and that's more than most redirection services are willing to invest (it's also fairly bad practice, as it's a single point of failure, as you can bet most providers won't use anycast).

If you want to have the root of your domain pointing to an ELB and work correctly with HTTP and HTTPS, the recommended way to do this is switch your DNS nameservers (you don't need to transfer the registration) to AWS Route53, as they support 'alias' records, where AWS will look up the IP address of your ELB (these change periodically, so don't try this yourself), and reply with the ELB details as a standard A record response.

A more generic way to do this, is to use a DNS provider that supports 'ALIAS' or 'ANAME' records, which work similar to the way Route53 works, but a little less intelligently (Route53 doesn't need to nslookup ELBs hostnames).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.