如何为在 aws EC2 中的 docker 上运行的 node.js 服务器设置 https

Question

I have a dockerised node.js/express app running on an aws ec2 instance container. Right now my app is running on a domain name hosted by aws route 53. When I go to the domain name the protocol used is http. How can I set up https for a node.js server running on docker in aws EC2?

This is what I have done so far.

1. I have set up a load-balancer on my ec2 instance with the target being https port 433.
2. I have a certificate with aws certificate manager with domain name as *.example.com. Issued by aws.
3. Do I need to do anything with docker since my app is being accessed through it. Does it need any https-enabling configuration?

Now this is where I get stuck. From this documentation I can see that I need a copy of the certificate in my server for https to work with my server.

1. Where do I get this copy? So I can put it in my server. Do I even need to do that?
2. Is the certificate in my aws certificate manager same as any other certificate issued by a certificate authority? If yes How can I see the private and public keys used in the https encryption?

I am new to devops and aws. If you could outline your answer in steps, from the beginning, it would be much appreciated. I have a dockerised node.js/express app running on an aws ec2 instance container accessible by an aws route53 hosted domain name. From here how can I change the default connection protocol from http to https?

Answer 1

Elastic Load Balancer is nice enough to append an extra request header to the request (x-forwarded-proto) which tells us from which protocol the request originated from. We can use this in an Express middleware to do redirections:

function forceHttps(req, res, next) {
    const xfp =
      req.headers["X-Forwarded-Proto"] || req.headers["x-forwarded-proto"];
    if (xfp === "http") {
      res.redirect(301, `https://${hostname}${req.url}`);
    } else {
      next();
    }
 }

server.use(forceHttps);

or use the npm package https://www.npmjs.com/package/@crystallize/elasticloadbalancer-express-force-https

const express = require('express');
const forceHttps = require('@crystallize/elasticloadbalancer-express-force-https');

const server = express();
server.use(forceHttps());