(bright instrumental music)
- Hi, I'm Sebastian, a cloud support engineer here
at the AWS office in Cape Town.
Sometimes, customers ask me how to configure
an Elastic Load Balancer in
an AWS Elastic Beanstalk environment
to use an SSL certificate.
This can be done by making a few changes
to the application bundle and the AWS Management Console.
Because Elastic Beanstalk manages
all of your infrastructure,
it is important to add the SSL certificate
through Elastic Beanstalk.
Otherwise, there will be inconsistencies between
the Elastic Load Balancer and Elastic Beanstalk.
Before we configure the Elastic Beanstalk environment,
we need an SSL certificate.
AWS Elastic Beanstalk and the Elastic Load Balancer
are integrated with AWS Certificate Manager.
With ACM, you can request a public ACM certificate,
or you can import your own certificates into ACM.
Let me walk you through the process
of requesting a new ACM certificate.
After logging into the AWS Management Console,
navigate to the AWS Certificate Manager in the console.
Choose Get started,
select Request a public certificate,
and then Request a certificate.
When the new screen appears,
enter the fully qualified domain name
of the website you want to use with SSL.
In this demonstration, I'll use my own.
Then choose Next.
From there, choose a validation option for the certificate
so that the Amazon Certificate Authority
can issue a certificate for your site.
You can choose either email validation or DNS validation
when you request a certificate.
I will choose DNS validation for this example.
Choose Review,
and then choose Confirm and request.
You've now requested a certificate,
but you'll need to validate it before we can proceed.
If your domain name is stored in Amazon Route 53,
click on the small arrow.
Then choose Create a record in Route 53.
Then choose Create.
You'll get a success message for the CNAME creation
and the verification process will start.
Verification can take some time to complete.
When this is complete,
you'll see that the status has changed
from pending validation to issued.
Now that we've completed the
AWS Certificate Manager validation process,
we can prepare the application bundle with the ebextension,
which will configure the HTTP to HTTPS redirection
on the Apache or NGINX proxy.
An ebextension is a configuration file for your source code
that allows you to customize AWS resources
and files during the application bundle deployment.
For this video, I'll use a sample application bundle.
However, you should do this with your own application.
First, let's download the sample application
from the documentation page.
You can find this link in the Knowledge Center article.
After downloading this, browse to the downloads folder
and extract the zip bundle.
Now browse to the AWS Labs GitHub repository,
which contains many example ebextensions
for different use cases.
And then download the required HTTP
to HTTPS ebextension for your environment.
Save it to the extracted source bundle.
You can find this link on
the Knowledge Center article with this video.
Note, if there is no ebextension folder,
you'll need to create one using the CLI.
When this is complete,
go to the root of your application bundle,
select all the files and zip the files
into an application bundle, zip.
And then rename it to something easy to remember
such as modifiednodejsv1.zip.
We'll use this in the next step.
I'm using the CLI to create the zip file.
Great.
Now that the application bundle is prepared
and the ACM certificate is generated,
we can configure the Elastic Beanstalk Elastic Load Balancer
with SSL and then upload the application bundle.
Let's do this now.
Navigate to the Elastic Beanstalk console.
Choose Get started if you do not have an environment yet.
Give the application a name.
In my case, I'm using sample blog.
Choose your environment.
In my case, I'm choosing Node.js.
Then choose Upload your code and find the zip file
that contains the HTTP to HTTPS redirection ebextension
called modifiednodejsv1.zip that we created earlier.
Then click Upload.
Choose Configure more options.
And in the new window, select High availability.
Choose Modify under load balancer.
For the default classic load balancer, select Add listener,
and then choose Listener port, 443,
Listener protocol HTTPS,
Instance Port 80 and Instance protocol HTTP.
For application load balancer,
make sure to select the incoming port, 443,
and protocol, HTTPS.
Be sure to set the ACM SSL certificate
to the one that we requested earlier.
In my case, I'm using blog.mydomainname.
Choose Add,
and then scroll down to choose Save.
Now choose Create app.
This may take some time.
Fantastic.
We've created the Elastic Beanstalk environment
and need to perform the last step to tie it all together.
This means creating the actual Route 53 alias record
for which we generated the ACM certificate for,
and then point the alias to
the Elastic Beanstalk generated URL.
Now, navigate to the Route 53 console.
Choose Hosted zones,
and then select your domain name.
Choose Create record set and then enter the same name
we used for the ACM certificate,
in this case, blog.
Select Alias yes and then click on the Enter target name
and scroll down to the Elastic Beanstalk sample application.
Choose Create.
Wait until the record has propagated
and then after some time, you'll be able to browse
to your newly created Elastic Beanstalk environment,
for example, blog.mydomainname.com.
You'll notice it performs an HTTP to HTTPS redirect,
which can be seen by the secure indication before the URL
and in the network section of the web development kit.
Thanks for watching and happy cloud computing
from all of us here at AWS.
(bright music)