使用Amazon S3虚拟主机和多层域时处理SSL证书吗？

Question

I have a domain, let's say foo.bar.com , which I want to use to serve files in an Amazon S3 bucket. According to https://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html , the bucket name has to be foo.bar.com and the URL foo.bar.com.s3.amazonaws.com for the CNAME record for foo.bar.com (pointing to foo.bar.com.s3.amazonaws.com ) to work.

Unfortunately, Amazon's SSL cert doesn't support foo.bar.com.s3.amazonaws.com (I mean, why would it, I guess), so I can't serve my files like this over SSL, I get an SSL warning/error. I can use plain HTTP but I get Mixed Content warnings in Chrome since the main site is over SSL.

How should this issue be dealt with?

Answer 1

The only way to have both a Custom domain name and SSL on a bucket is to use CloudFront in conjunction with S3.

Create an SSL cert for your domain foo.example.com in Amazon Certificate Manager (ACM) in the us-east-1 region, regardless of your bucket's region. (The us-east-1 region is the region where CloudFront and ACM are interconnected.)

Create a CloudFront distribution:

• if you want the S3 web site hosting features, including index documents and redirect rules, type the bucket's web site hosting endpoint hostname as the origin domain name (do not select the bucket from the list), or
• if you want to use CloudFront signed cookies or signed URLs, do select the bucket from the drop-down list.

Associate your new ACM cert with the distribution, and add foo.example.com as an Alternate Domain Name for the distribution.

Point the DNS record to the assigned dzczcexample.cloudfront.net hostname.

Note also that unlike S3 static hosting used by itself, this configuration does not require that the bucket name match the domain name, since CloudFront rewrites the requests before sending them to the bucket.