title: AWS EB - Significant issues getting SSL to work on re-terminated HTTPS behind application load balancer
body: <p>EDIT 3:</p>
  <p>The answer is I'm an idiot and left a listener on port 443 that redirected manually to the environment url.</p>
  <p>EDIT 2:</p>
  <p>It appears that my DNS records are not set correctly which is causing the site to be marked unsafe despite the certificate being indeed valid. Possible solution (related symptom) can be found in another of my SO posts <a href="https://stackoverflow.com/questions/68771424/elastic-beanstalk-environment-name-still-comes-up-on-the-url-bar-after-applying">here</a></p>
  <p>Basically I need to do the following (extracted from <a href="https://www.youtube.com/watch?v=BFh6zb43miE" rel="nofollow noreferrer">this</a> video)</p>
  <ul>
  <li>create a hosted zone per parent domain NOT the subdomain: example.com NOT subdomain.example.com regardless of number of subdomains</li>
  <li>request NS records (not CNAME records) per subdomain be entered by my admin into the parent domain host e.g. GoDaddy, Namecheap etc...</li>
  <li>use alias records as before for each subdomain pointing to relevant EB environment.</li>
  </ul>
  <hr />
  <p>EDIT:</p>
  <p>It turns out that I have created a certificate for my custom domain but the browser will not trust it because the site is being served from an *.elasticbeanstalk.com domain.</p>
  <p>No idea how to proceed as I cannot get an SSL for a domain I do not own.</p>
  <p><a href="https://i.stack.imgur.com/vqYQB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/vqYQB.png" alt="certificate fail in browser" /></a></p>
  <hr />
  <p>I have an application that uses Auth0, running inside EB behind an application load balancer (ALB).</p>
  <p>Auth0 requires to be run inside a secure environment, so I am terminating https at the load balancer and then re-terminating to send https through to the instance where it is terminated once again.</p>
  <p>I've essentially followed <a href="https://blog.commutatus.com/configure-ssl-in-elastic-beanstalk-application-part-2-2-f1c20e3f562f" rel="nofollow noreferrer">this</a> tutorial to achieve the use of a trusted SSL certificate, except I chose &quot;email confirmation&quot; and my global administrator approved the certificate. I've then added it to the ALB. Also there are no CNAME records in Route53 for these hosted zones.</p>
  <p>It is also worth mentioning that the team have routed from Godaddy parent domain to our NS records in AWS, which is configured in a hosted zone using Route53. This is an alias record that succesfully routes through to my application. Routing works just fine and redirects through to the application successfully.</p>
  <p>However, when I visit the site it still does not come up as secure. I've tested this across various machines to avoid any caching issues.</p>
  <p>There is a self-signed certificate on the instance itself. Is this certificate being served up to the public or is it the ALB certificate? Seems fairly obvious that it's the instance certificate.</p>
  <p>How then can I use the certificate in the ACM at the instance? According to AWS docs I can use a self-signed certificate without any issues.</p>
  <hr />
  <p>ALB listeners:</p>
  <p><a href="https://i.stack.imgur.com/yhSJO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yhSJO.png" alt="Here is a view of the application load balancer listeners" /></a></p>
  <p>Certificate in ACM (The ARN matches the above)</p>
  <p><a href="https://i.stack.imgur.com/erlOz.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/erlOz.png" alt="ACM Certificates" /></a></p>
  <hr />
  <p>For the configuration files below I followed these links
  <a href="https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https.html" rel="nofollow noreferrer">Configuring HTTPS for your Elastic Beanstalk environment</a></p>
  <p><a href="https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-elb.html" rel="nofollow noreferrer">Configuring a secure listener using the Elastic Beanstalk console</a></p>
  <p><a href="https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-endtoend.html" rel="nofollow noreferrer">Configuring end-to-end encryption in a load-balanced Elastic Beanstalk environment</a></p>
  <p><a href="https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-singleinstance-nodejs.html" rel="nofollow noreferrer">Terminating HTTPS on EC2 instances running Node.js</a></p>
  <p><a href="https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-singleinstance.html" rel="nofollow noreferrer">Configuring your application to terminate HTTPS connections at the instance</a></p>
  <hr />
  <p>I have the following .config files in .ebextensions directory of the application root folder:</p>
  <p><a href="https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-singleinstance.html" rel="nofollow noreferrer">Configuring your application to terminate HTTPS connections at the instance</a>
  https-instance-securitygroup.config:</p>
  <pre><code> Resources:
        sslSecurityGroupIngress: 
          Type: AWS::EC2::SecurityGroupIngress
          Properties:
            GroupId: {&quot;Fn::GetAtt&quot; : [&quot;AWSEBSecurityGroup&quot;, &quot;GroupId&quot;]}
            IpProtocol: tcp
            ToPort: 443
            FromPort: 443
            CidrIp: 0.0.0.0/0
  </code></pre>
  <p><a href="https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-endtoend.html" rel="nofollow noreferrer">Configuring end-to-end encryption in a load-balanced Elastic Beanstalk environment</a>
  .ebextensions/https-reencrypt-alb.config:</p>
  <pre><code>option_settings:
    aws:elbv2:listener:443:
      DefaultProcess: https
      ListenerEnabled: 'true'
      Protocol: HTTPS
    aws:elasticbeanstalk:environment:process:https:
      Port: '443'
      Protocol: HTTPS
  </code></pre>
  <p><a href="https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-singleinstance-nodejs.html" rel="nofollow noreferrer">Terminating HTTPS on EC2 instances running Node.js</a>
  .ebextensions/https-instance.config:</p>
  <pre><code>files:
    /etc/nginx/conf.d/https.conf:
      mode: &quot;000644&quot;
      owner: root
      group: root
      content: |
        # HTTPS server
  
        server {
            listen       443;
            server_name  localhost;
            
            ssl                  on;
            ssl_certificate      /etc/pki/tls/certs/server.crt;
            ssl_certificate_key  /etc/pki/tls/certs/server.key;
            
            ssl_session_timeout  5m;
            
            ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
            ssl_prefer_server_ciphers   on;
  
            # For enhanced health reporting support, uncomment this block:
  
            #if ($time_iso8601 ~ &quot;^(\d{4})-(\d{2})-(\d{2})T(\d{2})&quot;) {
            #    set $year $1;
            #    set $month $2;
            #    set $day $3;
            #    set $hour $4;
            #}
            #access_log /var/log/nginx/healthd/application.log.$year-$month-$day-$hour healthd;
            #access_log  /var/log/nginx/access.log  main;
            
            location / {
                proxy_pass  http://nodejs;
                proxy_set_header   Connection &quot;&quot;;
                proxy_http_version 1.1;
                proxy_set_header        Host            $host;
                proxy_set_header        X-Real-IP       $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto https;
            }
        }
        
    /etc/pki/tls/certs/server.crt:
      mode: &quot;000400&quot;
      owner: root
      group: root
      content: |
        -----BEGIN CERTIFICATE-----
        certificate file contents
        -----END CERTIFICATE-----
   
  </code></pre>
  <p><a href="https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-storingprivatekeys.html" rel="nofollow noreferrer">Storing private keys securely in Amazon S3</a><br />
  privatekey.config:</p>
  <pre><code>Resources:
    AWSEBAutoScalingGroup:
      Metadata:
        AWS::CloudFormation::Authentication:
          S3Auth:
            type: &quot;s3&quot;
            buckets: [&quot;application-keys&quot;]
            roleName: 
              &quot;Fn::GetOptionSetting&quot;: 
                Namespace: &quot;aws:autoscaling:launchconfiguration&quot;
                OptionName: &quot;IamInstanceProfile&quot;
                DefaultValue: &quot;aws-ec2-eb-*****-role&quot;
  files:
    # Private key (backend_app_server)
    &quot;/etc/pki/tls/certs/server.key&quot;:
      mode: &quot;000400&quot;
      owner: root
      group: root
      authentication: &quot;S3Auth&quot;
      source: https://****.amazonaws.com/****.pem
  </code></pre>