一个EC2实例上有多个SSL证书

Question

I have an ec2 instance which is pointed to by 2 different domains (.com.au and .co.nz). This works fine.

I am trying to set up SSL for both domains. Currently I have used LetsEncrypt and successfully set up SSL for the co.nz domain, and now wish to do the same for the .com.au.

I have followed the guide here:

https://www.haktansuren.com/installing-free-letsencrypt-ssl-multiple-domains-sub-domains-amazon-web-services-aws-ec2-simple-way/

But when I run the .com.au site through SSLLabs.com I get a "Certificate name mismatch error" and when I try to go straight to the .com.au domain I get this (from chrome) "This server could not prove that it is **.com.au; its security certificate is from **.co.nz."

The .com.au domain is the second "virtual host" entry in the ss.conf file, and when I change the order then I get the same error for the .co.nz domain so it seems to be only reading one of the entries or something?

Thanks a bunch for any help

Answer 1

1. You can create a free certificate for any domain you want using ACM .
2. Create a Elastic Load Balancer and select the certificate you've just created.
3. Connect the EC2 instance to Elastic Load Balancer

The best practice is to create a Launch Configuration and create a Auto Scaling Group and let the ASG handle creation of EC2 instances. In AWS your instances can be killed at any time, it is not a good practice to rely on a single EC2 instance. You can lose it suddenly with all data you might have stored in the ephemeral storage!

Answer 2

In case of Apache:

You can terminate SSL certificates either at ELB or Apache/Nginx(server) level

In case of multi-tenant(multi-client) architecture, we may need to support different customers(with different domains - *.abc.com, *.xyz.com) under a single ELB, which will not work in an existing ELB setup.

Solution: You can do this by adding listeners in ELB like below: TCP 443 (instead of HTTPS - 443) - this will pass through the 443 requests Then, you can terminate the SSL certificates at the server level

You have to purchase the certificate from external vendors (like GoDaddy) and install & terminate the certificates at the server level.

Eg, Apache virtual host looks like

NameVirtualHost *:443
<VirtualHost *:443>
        ServerName abc.com

        ####abc HTTPS Certificate
        SSLEngine on
        SSLCertificateFile /opt/organization/site/ssl_keys/abc/abc_gd.crt
        SSLCertificateKeyFile /opt/organization/site/ssl_keys/abc/abc.pem
        SSLCertificateChainFile /opt/organization/site/ssl_keys/abc/abc_gd_bundle.crt

        WSGIScriptAlias / /opt/organization/site/deployment-config/abc.wsgi

        ServerSignature On
        Alias /media/ /opt/organization/site/media/
        <Directory /opt/organization/site/media/>
        Order deny,allow
        Allow from all
        </Directory>
</VirtualHost>

NameVirtualHost *:80
<VirtualHost *:80>
        ServerName abc.com

        #Rewrite to HTTPS in case of HTTP
        RewriteEngine On
        RewriteCond %{SERVER_NAME} abc.com
        RewriteCond %{HTTP:X-Forwarded-Proto} !https
        RewriteRule . https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

        WSGIScriptAlias / /opt/organization/site/deployment-config/abc.wsgi
        ServerSignature On
        Alias /media/ /opt/organization/site/media/
        <Directory /opt/organization/site/media/>
        Order deny,allow
        Allow from all
        </Directory>
</VirtualHost>