我可以在 AWS 提供的 ALB 子域上设置 SSL 而不拥有域吗？

Question

I have following setup at AWS ECS:

• Container with Caddy web-server at 80 port that serves static files and performs proxying of /api/* requests to backend
• Container with backend at 8000 port
• EC2 instance at ECS
• ALB at subdomain http://some-subdomain-12345.us-east-2.elb.amazonaws.com/ (subdomain was provided automatically by AWS) with HTTP Listener

I want to setup SSL certificate and HTTPS Listener for ALB at this subdomain that was provided by AWS - how I can do it?

PS I have seen an option for ALB with HTTPS Listener when we are attaching custom domain ie example.com and AWS will provide SSL certificate for it. But this is a pet project environment and I don't worry about real domain.

Answer 1

I want to setup SSL certificate and HTTPS Listener for ALB at this subdomain that was provided by AWS - how I can do it?

You can't do this . This is not your domain (AWS owns it) and you can't associate any SSL certificate with it. You have to have your own domain that you control. Once you obtain the domain, you can get free SSL certificate from AWS ACM.

Answer 2

You can put your ALB behind CloudFront , which unlike ALB gives you a TLS certificate by default. So you can address your application at eg:

https ://d3n6jitgitr0i4.cloudfront.net

Apart from the TLS certificate, it will give you the ability to cache your static resources at CloudFront's edge locations, and improve latency on the TLS handshake roundtrips.

Answer 3

This could be a solution without using subdomains but using path redirection

https://caddy.community/t/caddy-2-reverse-proxy-to-path/9193