51

I am trying to add an HTTPS listener to my EBS classic load balancer. I used the CLI upload-certificate tool to upload my cert (using the GUI never resulted in the cert showing up as an option on the load balancer form. No errors, logs, events).

I set up the listener according to AWS docs.

  • For Listener port, type the incoming traffic port, typically 443.
  • For Listener protocol, choose HTTPS.
  • For Instance port, type 80.
  • For Instance protocol, choose HTTP.
  • For SSL certificate, choose your certificate.

I choose my cert (Lets Encrypt), save and I see the new listener with a Pending Create tag. It never transitions from that status and if I refresh the page, the record is gone. No error, no logs, no events. Really want to make AWS work but Beanstalk has been extremely buggy. Any suggestions?

Brad Solomon
  • 38,521
  • 31
  • 149
  • 235
Half_Duplex
  • 5,102
  • 5
  • 42
  • 58
  • 1
    Are you using a single instance environment, or a load balanced environment? – Mark B Jul 07 '18 at 19:03
  • Load balanced. Single instances don’t give you an option to add LB listeners. – Half_Duplex Jul 07 '18 at 21:08
  • Are you using `aws acm import-certificate` or `aws iam upload-server-certificate` or something else? It also doesn't make sense that uploading via the GUI didn't work. Did you try loading it into Amazon Certificate Manager (ACM)? – Michael - sqlbot Jul 07 '18 at 21:57
  • I used `aws iam upload-server-certificat`. I uploaded the certificate using ACM, it worked but the cert would never show up when configuring the classic load balancer. I have seen others report the same, which is where I saw the CLI workaround. – Half_Duplex Jul 07 '18 at 23:45
  • Using `aws acm import-certificate` I am able to also see the cert show up in ACM, but like with the GUI, the cert does not show up in the cert drop down on the load balancer Add Listener modal. – Half_Duplex Jul 07 '18 at 23:55
  • 1
    If you are using a load balancer why wouldn't you use the free ACM certificates that auto-renew instead of trying to use the short-lived Let's Encrypt certificates that you will have to continually be re-uploading? – Mark B Jul 08 '18 at 02:12
  • Would that work if I use a GoDaddy sub domain that points to my EBS with an A record? I was planning on forcing HTTPS from GoDaddy with the htaccess file. Hence the Let’s Encrypt. I will also need to be folder specific in htaccess since /v1 of the product will remain HTTP. I didn’t think I could achieve this with the ACM cert. Thanks. – Half_Duplex Jul 08 '18 at 13:13
  • 1
    The fact that the DNS record exists at GoDaddy is entirely irrelevant to the issue. Yes it will work fine. The `htaccess` stuff you are talking about is Apache server configuration on the actual EC2 server, which definitely doesn't care where your DNS server is. And if you are installing an SSL certificate on the load balancer, it doesn't matter where the SSL certificate is from (ACM or anything else) it's going to behave the same way from the server/Apache/htaccess perspective. You are confusing a lot of unrelated issues here. – Mark B Jul 08 '18 at 13:23
  • Gotcha. I will try the ACM route and moving my htaccess from external hosting to EBS or a load balancer config. – Half_Duplex Jul 08 '18 at 13:27
  • Anyway, have tried now with the ACM cert, and my listener is still not being created :/ – Half_Duplex Jul 08 '18 at 14:42
  • Wanted to circle back to @MarkB comments regarding an AWS vs LetsEncrypt cert (or any other cert for that matter) as they may send some in the wrong direction. Hosting HTTPS content and directing subdomain traffic to AWS requires a wildcard cert installed both places, which is not possible with ACM, hence LetsEncrypt and eventually a paid cert. There was no confusion of issues, rather an off topic question that should be disregarded. The good news is AWS is rolling out new UIs across EC2, so this may eventually be improved. – Half_Duplex Jul 03 '21 at 05:04
  • @Half_Duplex AWS ACM absolutely supports wildcard certificates. It sounds like you may be running into a limitation of the Elastic Beanstalk UI? You should think about using a tool like Terraform or CloudFormation instead of relying on the AWS web UI. – Mark B Jul 03 '21 at 15:27
  • @MarkB Actually, AWS ACM certs cannot be used outside of AWS, for example to protect externally hosted web content. You may be misunderstanding the goal, but we're way off topic. You should check out the accepted answer below, it may clear things up for you. – Half_Duplex Jul 22 '21 at 00:33
  • @Half_Duplex I never said ACM certs could be used outside of AWS. Not sure how you even got that from my comments. I actually said you were probably running up against limitations of the AWS web user interface, which is what you ended up posting as the answer. – Mark B Jul 22 '21 at 13:02

1 Answers1

212

I figured out what I wasn't doing.

On the load balancer settings page, after you click "Add Listener", fill out the details and click "Save Listener", you're actually not done. You have to scroll to the bottom of the page and click "Save" (or "Apply") again. Not the best UI. User should never have to save twice, and at the very least, alert the user they are leaving unsaved changed.

Brad Solomon
  • 38,521
  • 31
  • 149
  • 235
Half_Duplex
  • 5,102
  • 5
  • 42
  • 58