How can i automate AWS EC2 SSL certificate?

2
votes

I am spinning a new EC2 instance on demand using AMI by script using Java SDK from here at http://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/welcome.html

I am hosting rest API's on the newly spun EC2 instance from AMI on port 8000. I want to access instance from IP only as I will spinning many instances from base AMI when needed and will be destroying when not needed.

I want to call this API's from another web application which is hosted under HTTPS. I know it will not allow me to hit HTTP from HTTPS due to Mixed Content.

After some research, I found AWS provides ACM-Server Certificates service which can be applied to EC2. Ref http://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/examples-iam-server-certificates.html

But it works with services integrated with ACM as per document saying at below link

http://docs.aws.amazon.com/acm/latest/userguide/acm-services.html >> You cannot install an ACM Certificate directly on your website or application. You must install your certificate by using one of the services integrated with ACM. For more information about these services, see Services Integrated with AWS Certificate Manager.

  • Elastic Load Balancing
  • Amazon CloudFront
  • AWS Elastic Beanstalk
  • Amazon API Gateway AWS
  • CloudFormation

But I am not using any of above-mentioned services. Is there any way to achieve this and install SSSL on EC2 ip using script ?

1
amazon-web-servicessslamazon-ec2aws-sdk

1 Answers

1
votes

This is a common question, because AWS ACS certificates are free.

Thus, to avoid using such certificates with other services than AWS ones, AWS never discloses the associated private keys to its customers.

To let the https server on your EC2 instance use such a certificate, AWS should give you the private key, for you to configure the https server itself.

This is why you can not use an ACS certificate with your EC2 instance. You need to configure an Elastic Load Balancing instance in front of it, so that AWS provides this ELB with your certificate and private key (or provide an HSM with this private key and connect this HSM to the ELB front-end).

Note that using an ELB instance in front of your EC2 instance, in order to be able to use a free certificate from the AWS ACS service, is probably a bad idea: certificates are often cheaper (depending on their type and duration, of course) than the ELB cost overhead.

Note that Let'sEncrypt (https://letsencrypt.org/) can provide your EC2 instance with free DV (domain validated) certificates. You just need to install the Certbot ACME client, since you have shell access to your EC2 instance.