0

I think I misunderstand the concept of adding ssl protection to my aws ec2 instance with a load balancer!

I have an Ionic app web, ios and android. I want to switch all http requests to https.

What I did:

  1. Purchasing a url with route53
  2. getting certificate with acm
  3. setting up a load balancer like this...
  • https:443 -> ec2 instance (Here a applied the certificate)
  • http:80 -> https:443
  • http:8080 -> https:443
  1. In Hosted Zones I added an A type record that points from my url to the Load balancer.

  2. In my Ionic code I changed the endpoint addresses to https://my-backend-api-url.com/ (Yes I changed the my-backend-url.com in the real url :)

in the web deployment this set up lets me call the backend. But in the ios and android deployments it doesnt work and returns a 0 unknown error. In the load balancer i can see that the requests from mobile deployments produce client tls negotiation errors.

My Attempt to fix this:

If I understand it right ( and there is a big if) I need a ssl/tls certificate that is in my app build in a certificate folder and i need the same certificate on my load balancer. Since aws ACm certificates only work for other aws services I think I can not use the certificate I created and applied via ACM. So I think I need an ssl certificate from an ca and tried to get one with: sudo certbot certonly --apache

When i enter my url it says:

"Unable to find a virtual host listening on port 80 which is currently needed for Certbot to prove to the CA that you control your domain. Please add a virtual host for port 80"

Maybe also helpful to know is that I can access my backend api with the browser but it shows me that its unsecure and certificate is not valid:

enter image description here

Am I on the right track with my approach or did I completely misunderstand something? If my approch is correct what do I have to do that certbot can access port 80.

Any hint, link to a good tutorial, or help in any way is highly appreciated.

1 Answer 1

0

I think there is no need to get an ssl certificate from an external provider. You are accessing without ssl your load balancer. Your load balancer is doing the decryption for you. So, just check that your load balancer is in a security group with an open 443-port.

Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.