在 Elastic Beanstalk 单实例上配置 SSL

Question

I'm trying to install an SSL cert for my NodeJS Beanstalk instance. Following these instructions from Amazon , I created the YAML file and plugged in my information.

Every time I try to deploy I get this error:

The configuration file .ebextensions/singlessl.config in application version 0.0.3 contains invalid YAML or JSON. YAML exception: while scanning for the next token found character '\\t' that cannot start any token in "", line 10, column 1: ^ , JSON exception: Unexpected character (R) at position 0.. Update the configuration file.

I've gone over the thing with a fine-toothed comb, had it validated in multiple validators, even authored it on multiple OS's... but I can't seem to shake this supposed tab character.

Does anyone have an example of a config file like this in JSON? My other configs are in JSON and work great. If not, can anyone see what I'm doing wrong here?

Resources:
  sslSecurityGroupIngress: 
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: {Ref : MyIDHere}
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      CidrIp: 0.0.0.0/0

files:
  /etc/nginx/conf.d/ssl.conf:
    mode: "000755"
    owner: root
    group: root
    content: |
      # HTTPS server

      server {
          listen       443;
          server_name  localhost;

          ssl                  on;
          ssl_certificate      /etc/pki/tls/certs/server.crt;
          ssl_certificate_key  /etc/pki/tls/certs/server.key;

          ssl_session_timeout  5m;

          ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
          ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
          ssl_prefer_server_ciphers   on;

          location / {
              proxy_pass  http://nodejs;
              proxy_set_header   Connection "";
              proxy_http_version 1.1;
              proxy_set_header        Host            $host;
              proxy_set_header        X-Real-IP       $remote_addr;
              proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
          }
      }

  /etc/pki/tls/certs/server.crt:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN CERTIFICATE-----
      CERT DATA HERE
      -----END CERTIFICATE-----

/etc/pki/tls/certs/server.key:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN RSA PRIVATE KEY-----
      KEY DATA HERE
      -----END RSA PRIVATE KEY-----

Answer 1

At line 10 there is a tab character. Deleting this tab should resolve the error you are receiving.

When you copied the code from instructions from Amazon, it copied over a tab which will cause this problem. I encountered the same problem, if you go through the YAML file and make sure that there are no weird white space characters it should work properly.

Answer 2

For me after going through the same routine with AWS Beanstalk Single Instance SSL for HTTPS (for Docker env) and after time spent with figuring out YAML and tabs vs space(or no space after keys footer, or or..) in my editor(Atom/Packages/Whitespace), or even convert YAML to JSON(Atom/Packages/YAML_JSON Converter), I have realized that the initial keys were broken and had to generate a new set :

openssl genrsa 2048 > privatekey.pem
openssl req -new -key privatekey.pem -out csr.pem
openssl x509 -req -days 365 -in csr.pem -signkey privatekey.pem -out public.crt
# last line is for signing the rsa yourself for development purposes.

And then all worked! So I can't emphasize how important is to make sure those keys work. Seems that the only way to figure it out is to get some errors like this:

PEM_read_bio_PrivateKey:ASN1 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I: nested asn1 error

Good luck!

PS: oh and in case you run into a __MACOSX/ error just do this:

 zip -d Archive.zip __MACOSX/\*