27

I want to enable ssl on an EC2 instance. I know how to install third party SSL. I have also enabled ssl in security group.

I just want to use a url like this: ec2-xx-xxx-xxx-xx.compute-1.amazonaws.com with https.

I couldn't find the steps anywhere.

It would be great if someone can direct me to some document or something.

Edit:

I have a instance on EC2. On Which I have installed LAMP. I have also enabled http, https and ssh in the security group policy.

When I open the Public DNS url in browser,I can see the web server running perfectly. But When I add https to URL, nothing happens.

Is there a way I am missing? I really dont want to use any custom domain on this instance because I will terminate it after a month.

Neeraj Kumar
  • 681
  • 1
  • 8
  • 21
  • what is your exact question? Are you asking for SSL tutorial? If yes, then refer http://www.sslshopper.com/. – slayedbylucifer Nov 12 '13 at 10:35
  • 1
    No. I want to know, is there a default amazonaws.com wildcard that I can install on my ec2 instance? I dont want to use any domain name on my EC2 instance. I want to use default public DNS name that I get with a EC2 instance with SSL – Neeraj Kumar Nov 12 '13 at 11:15
  • Amazon does provide SSL certificates now. https://us-west-1.console.aws.amazon.com/acm/home – Danny Robinson Jun 30 '16 at 16:03

4 Answers4

12

For development, demo, internal testing, (which is a common case for me) you can achieve demo grade https in ec2 with tunneling tools. Within few minutes especially for internal testing purposes with [ngrok] you would have https (demo grade traffic goes through tunnel)

Tool 1: https://ngrok.com Steps:

  1. Download ngrok to your ec2 instance: wget https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-linux-amd64.zip (at the time of writing but you will see this link in ngrok home page once you login).
  2. Enable 8080, 4443, 443, 22, 80 in your AWS security group.
  3. Register and login to ngrok and copy the command to activate it with token: ./ngrok authtoken shjfkjsfkjshdfs (you will see it in their home page once you login)
  4. Run your http - non https server (any, nodejs, python, whatever) on EC2
  5. Run ngrok: ./ngrok http 80 (or a different port if your simple http server runs on a different server)
  6. You will get an https link to your server.

Tool 2: cloudflare wrap

Alternatively, I think you can use an alternative to ngrok which is called cloudflare wrap but I haven't tried that.

Tool 3: localtunnel

A third alternative could be https://localtunnel.github.io which as opposed to ngrok can provide you a subdomain for free it's not permanent but you can ask for a specific subdomain and not a random string.

--subdomain request a named subdomain on the localtunnel server (default is random characters)

Tool 4: https://serveo.net/

Tomer Ben David
  • 8,286
  • 1
  • 43
  • 24
11

Turns out that Amazon does not provide ssl certificates for their EC2 instances out of box. I skipped the part that they are a virtual servers providers.

To install ssl certificate even the basic one, you need to buy it from someone and install it manually on your server.

I used startssl.com They provide free basic ssl certificates.

Neeraj Kumar
  • 681
  • 1
  • 8
  • 21
  • 3
    What is the difference between "basic" and "non-basic" certificates ? I'm struggling to understand why price difference is so huge, from $5 to $250/year. – OutputLogic Apr 18 '15 at 17:16
  • 1
    Did you find out what is the difference between basic and non-basic packages? I am also looking to find an ssl certificate that my browser does not complain about. I found out that there is a project called "Lets Encrypt" that is going to provide such certificates for free, but it will come in October... – Mahshid Zeinaly Sep 24 '15 at 01:56
  • Could you please elaborate how did you go through the process with StartSSL as far as I know you need to validate the top-level domain with them, which you cannot do with the EC2 address since it belongs to Amazon. – Cenobyte321 Oct 01 '15 at 17:20
  • 1
    @Nab I bought a domain name and created a certificate for that domain name. Then I mapped it using CNAME record to EC2 public DNS record. – Neeraj Kumar Oct 01 '15 at 21:00
7
  1. Create a self signed SSL certificate using openssl. CHeck this link for more information.
  2. Install that certificate on your web server. As you have mentioned LAMP, I guess it is Apache. So check this link for installing SSL to Apache.

In case you reboot your instance, you will get a different public DNS so be aware of this. OR attach an elastic IP address to your instance.

But When I add https to URL, nothing happens.

Correct, your web server needs to have SSL certificate and private key installed to serve traffic on https. Once it is done, you should be good to go. Also, if you use self-signed cert, then your web browser will complain about non-trusted certificate. You can ignore that warning and proceed to access the web page.

Community
  • 1
  • 1
slayedbylucifer
  • 22,878
  • 16
  • 94
  • 123
  • 4
    Thanks. This works. But, doesn't AWS have there own wildcard ssl available somewhere which I can install? Installing self signed certificates will always give warning on browsers. I dont want that. Because I will be using these for Facbeook Apps. And they require SSL. I dont want to buy a domain name either. – Neeraj Kumar Nov 13 '13 at 07:19
  • 2
    I am not aware such cert from AWS. Try posting your queries on [AWS forum](https://forums.aws.amazon.com/index.jspa) where you might get a better insight from AWS people. – slayedbylucifer Nov 13 '13 at 07:27
  • @NeerajKumar AWS does has their SSL. [Here](https://aws.amazon.com/blogs/aws/new-aws-certificate-manager-deploy-ssltls-based-apps-on-aws/) is a guide to it. – mobby Sep 19 '17 at 20:35
1

You can enable SSL on an EC2 instance without a custom domain using a combination of Caddy and nip.io.

nip.io is allows you to map any IP Address to a hostname without the need to edit a hosts file or create rules in DNS management.

Caddy is a powerful open source web server with automatic HTTPS.

  1. Install Caddy on your server

  2. Create a Caddyfile and add your config (this config will forward all requests to port 8000)

    <EC2 Public IP>.nip.io {
    reverse_proxy localhost:8000
}

    enter image description here

  3. Start Caddy using the command caddy start

You should now be able to access your server over https://<IP>.nip.io

enter image description here

I wrote an in-depth article on the setup here: Configure HTTPS on AWS EC2 without a Custom Domain

Anuj Bansal
  • 1,643
  • 1
  • 12
  • 9
  • I have same requirement but I am running a Tomcat Server in my ec2 instance. So, let's say if i install caddy server then are you sure my tomcat server will able to serve https request to my clients. – Sumit Kandoi Feb 09 '22 at 14:23