2

For the life of me, I can't figure out what I am doing wrong. I followed the AWS documents to add SSL on a classic ELB (I tried the NLB which still failed for us).

Basically, we have a webserver which listens on port 80. I want to have SSL termination happen at the ELB.

I added the ELB correctly, added a security group for it's network interfaces (even tried a dangerous allow all inbound outbound). I also tried this for the instance's security group.

When I would navigate to https://mytestserver.com/resource it would default to http - but for the login page, would show https. Once logged in, it would use http after.

I read mixed things in the docs/online, that said for the SSL termination, you need to have a 443 elb listener port --> instance port 80 AND also, another rule with 80 ELB listener port ---> instance port 80.

If I try to remove the rule for the 80 elb listener port --> instance port 80, I can login -- but the page hangs.

It is loading some flash components, so I did make sure to enable the ports for that. I even tried a temporary 'allow' all, as previously mentioned for the security group for the LB and the instance.

It's making me think that the instance's web server (this is an external customer webserver which is running an application on of our team uses, which is using jetty) does not like some sort of header injection that is happening.

When I removed the listener for port 80 on the elb, I wiresharked my computer, and it showed that it kept trying to reach on port 80 to the elb....any ideas!?

Thanks!

P.S. I should mention, without the SSL stuff in place, the http version of the site works fine.

  • So the problem is that after you login over HTTPS you're redirected back to HTTP? Is that the core issue you're looking to solve? – MLu Mar 19 '19 at 20:49
  • sorry, yes i should have been more clear... – 2legit2quit Mar 19 '19 at 21:49
  • Sounds like your application needs to be configured or modified to send the correct protocol link to the client. There's not much reason to have anything http these days, make it all https. – Tim Mar 19 '19 at 21:54
1

Once you are logged in your backend sends back a HTTP Redirect with a new Location specifying where the browser should now go.

Becuase you terminate SSL on the ELB the backend app probably detects that the traffic is coming on port 80 over HTTP and builds the redirect link as http://mytestserver.com/... (note it's HTTP because the server thinks the request arrived over HTTP as that's how ELB talks to it).

What you need to do is to change your app or the server config to always return URLs starting with https://. How to do that depends on your web application and/or the web server in use.

For one possible solution have a look here: AWS redirecting to SSL ERR_TOO_MANY_REDIRECTS

Hope that helps :)

| improve this answer | |
  • thank you, that makes perfect sense. the customer application is using Jetty in windows, so looks like I will have to research how to do that.. The SSL_ERR_TOO_MANY_REDIRECTS issue I read about before, and is not the issue I'm having. It sounds like the issue is the jetty server is responding back with the http as you mentioned. I think I made an assumption that the ELB would add the redirect – 2legit2quit Mar 20 '19 at 15:08
  • @2legit2quit Nope the ELB doesn't alter the response, your Jetty will have to send the client to the right place. You can examine the X-Forwarded-For request header in Jetty to figure out what protocol and hostname the client was using and use that as the base url for the redirect. BTW If it solves your problem mark the answer as accepted plz, thanks :) – MLu Mar 20 '19 at 21:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.