Nginx Question posted in
The official documentation can be found here.

SSL AWS EC2 backend with S3 frontend – Nginx

I have a VueJS front-end application running on S3 being served as a static website.

I have a NodeJS (behind an nginx reverse proxy, plus a few other services) backend application running on an EC2 instance that the VueJS app talks to (over http currently).

I have a domain successfully pointed at the VueJS app (S3 bucket) with the configured SSL certificates using Route53 / CloudFront / ACM.

However, now the VueJS app will not communicate with the EC2 instance backend as it is still using HTTP which is now not allowed.

So what is the best way to configure this? I can’t run certbot on the ec2 instance and generate an SSL certificate for my domain as there are certificates already being used for the S3 bucket.

Should I just create a self-signed certificate?

Can I create another certificate for a subdomain perhaps (api.example.com say) and set up DNS record for that to point to my EC2 instance IP address?

How is this usually done, what is best practice?

Tags:

2

Answers


  1. 0

    Usually you create some subdomain like you said for your api and create a certificate for that subdomain. On AWS in particular, you can use an elastic load balancer and use ACM /Route53 with that for ease of certificate management, but that does carry costs of the load balancer.

    Alternative is to just put an API gateway in front of your EC2 instance as a reverse proxy, which will carry some costs, but maybe not as much depending on traffic volume.

    Login or Signup to reply.
  2. 0

    So a self-sign cert wont work, it wont pass validation as there is no known CA behind it ( Certificate authority) I mean you can install it but the browser is going to complain..

    Im not sure I understand why you cant use certbot.. s3 / ec2 are two seperate services so I’m a bit confused here?

    You can use letencrypt to generate a cert for the server and have it installed as well but if you have clusters you may be better served by installing it on the actual ALB, however this does not ensure end-to-end if the cert is not installed on all backend systems, (that would require installing the cert on all systems in the cluster) You requirements will dictate this really.

    If you are unable to generate a cert with letsencrypt you can get an SSL from ssls.com and just installed the PEM or CRT on the server / load balancer too though.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search