3

Starting to setup a Load Balanser in AWS, I ran into some additional questions.

Basically I have a web site/app deployed in an EC2 instance. I'd like to make it secure by using an AWS generated cert via Certificate Manager. As I already have understood EC2 cannot itself manage this and one easy way to enable it would be to deploy a Load Balancer in front of EC2 which secures the client communication with my ACM certificate.

Maybe easy, but not for me...

QUESTION 1: Since I don't want to deploy multiple EC2 instances I need to deploy a "Classic Load Balancer" instead of an "Application Load Balancer" (since the latter requires at least 2 EC2 instances). Is this correct?

QUESTION 2: I want the visitors of the web site to get the "secure" indication in their browsers. I assume this means I need to use HTTPS all the the way client <-> Load Balancer <-> EC2, and cannot terminate the SSL/HTTPS in the LB. Is this a correct assumption?

QUESTION 3: If the previous assumption is correct, should I then use another certificate for the HTTPS communication between the Load Balancer and EC2? Afaiu the one I have in ACM cannot be used. Would the correct way be to generate a new, private certificate in ACM to use for this?

QUESTION 4: If so, would a private certificate still give the end-user the benefit of a fully signed certificate, or would it be seen as a self-signed cert (which I don't want)?

QUESTION 5: Maybe totally wrong (and showing how much I really know about certifiates ;-) but since I already have another ssh-certificate (from my IAM user, which I use to ssh to the ec2 instance) on the ec2 instance, could this one be used in the Load Balancer <-> EC2 step?

Ok, that's all I think, at least for now... Thanks!

UPDATE Thanks to the helpful answers I got this to work, and turns out easier than I thought when writing the original question. I just launched an "Application Load Balancer" with http an https listeners with my ACM cert, keeping all the default options. Adding a CNAME entry in my external DNS to my loadbalancer's DNS name and the SSL works just fine.

4

You can use a Let's Encrypt certificate, or any other certificate, directly on your EC2 instance. You can't use an ACM certificate though. This would avoid the need for a load balancer. I have a short tutorial about that here.

To answer your questions

  1. I don't think an ALB requires multiple EC2 instances, one should be fine.

  2. If set up correctly you can terminate HTTPS on the load balancer and the browser will still show the connection as secure. This is generally appropriate for most workloads as the AWS internal network is considered trust and secure.

  3. You could do end to end encryption, using any other type of certificate.

  4. You'd have to check if self signed certificates work with ALB. Given Let's Encrypt is free and easy I don't see why you'd bother.

  5. No, they're different types of certificate.

7
  • It may be tricky to create Lets Encrypt certificates on an EC2 behind a load balancer - not sure how much it will like the SSL termination on the ALB. It may be necessary to use DNS-based verification. But I haven't tried. – MLu Oct 15 '18 at 22:03
  • You may be right there. My read of the question is they're ok with one EC2 instance, and are adding a load balancer just to get an ACM cert. Using a single instance with an LE cert would be cheaper and easier. If you have multiple instances behind the load balancer you'd need some process to distribute that certificate to multiple servers. – Tim Oct 15 '18 at 22:17
  • Thank you. If I can get away with not having any cert on the EC2 I will go for that alternative for sure (your #2 answer above). I did try that already, terminating HTTPS in the LB and just doing HTTP towards EC2, couldn't get it to work though, I guess the key lies in "if set up correctly" :-) If you have any quick hint about this feel free to share, otherwise it might merit another question later on. – jola Oct 16 '18 at 5:35
  • I wasn't really aware there was any special setup. Basically the ALB / ELB terminates https, decodes the request, then makes another request to the EC2 server over http or https. It takes the result and sends it back to the original client. The protocol used between ALB and EC2 is largely irrelevant. There may be security features I'm not aware of, there's all kinds of headers in http these days. Also your web server needs to return pages with links / images to https resources, which means configuration. It's probably easier to put a Let's Encrypt cert on the EC2 instance. – Tim Oct 16 '18 at 6:51
  • Also, if you want https and just want the easiest way, you can drop the ELB and just put a Let's Encrypt cert on the EC2 instance. It might be a bit more learning than just using ELB and ACM, but once a Let's Encrypt client is set up it will typically renew indefinitely with no intervention. – Tim Oct 16 '18 at 6:52
3

To directly answer your question: No, you don't need a SSL certificate on the EC2 server when your Load Balancer terminates SSL. You can though and it can be any valid SSL certificate, even a self-signed one. ALB will accept that.

And no, you don't need two EC2 instances behind an ALB, one EC2 will do just fine.

And no, you can't use SSH certificate as a HTTP SSL certificate, they've got different structure.

Hope that helps :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.