Can I use Single AWS ELB to host 2 SSL Certs for 2 Different Domains?

Question

On AWS, I'm hosting Multiple (totally different) Domains on EC2 covered by an ELB on top. I already have 1 Wildcard SSL Cert for 1 Domain and its childs. (xxxx.site1.com)

Then now can I add one more Single SSL Cert (on same ELB) for 1 another different Domain, like (www.site2.com) please?

I'm asking this because some Articles are saying, it won't work and just crush.

Please kindly advise.

You can now have multiple domains, simply use Amazon ACM (AWS Certificate Manager) to create a certificate with multiple domains, then use that in your ELB. https://console.aws.amazon.com/acm/ — , Oct 14 '17 at 22:26

score 14 · Accepted Answer · answered Feb 20 '14 at 15:44

14

No. The only way you could do it is if you use a second port for HTTPS connections (other than 443) which doesn't apply to real world scenarios since 443 is the default port for HTTPS

Having said that, you can simply create a second ELB and assign your second wildcard certificate to it. You can also forward your traffic to the same backend server as the one where the first ELB is forwarding its traffic to.

Hope this helps.

answered Feb 20 '14 at 15:44

Rico

58,485
12
111
141

Yes, this make sense. And the other way round (but not so common) is to directly apply the Cert onto the Instance(s). – 夏期劇場 Feb 21 '14 at 01:41
2

You could also get a SAN (Subject Alternative Name) Certificate (also known as a UCC Certificate) that allows for you to use secure multiple domains with a single SSL certificate. It might not work for you because you are requiring a wildcard certificate, but it might help others who don't need a wildcard. Read more about SAN Certs here: https://www.digicert.com/subject-alternative-name.htm – michaelrmcneill Feb 23 '15 at 20:07

Garth Kerr · Answer 2 · 2016-01-11T03:31:56.357

Yes. But not by terminating SSL on the load balancer. You have to enable Proxy Protocol on the ELB and transparently forward TCP requests to the web server. There are more details in this article on how to configure the ELB with example NGINX configurations:

Multiple SSL domains on AWS ELB with Nginx

Using the AWS CLI to enable:

aws elb create-load-balancer-policy \  
  --load-balancer-name acme-balancer \
  --policy-name EnableProxyProtocol \
  --policy-type-name ProxyProtocolPolicyType \
  --policy-attributes AttributeName=ProxyProtocol,AttributeValue=True

aws elb set-load-balancer-policies-for-backend-server \  
  --load-balancer-name acme-balancer \
  --instance-port 9443 \
  --policy-names EnableProxyProtocol

aws elb describe-load-balancers --load-balancer-name acme-balancer

There is also a mod_proxy_protocol module available if you are using Apache.

This does NOT add an additional distribution layer; ELB still handles distributing the traffic, connection draining. However, SSL termination is handled by each individual server.

please, add the most valuable parts from the link into your answer. — sobolevn, Jan 09 '16 at 06:10
Does it mean Nginx here, will become an "additional" Load Balancer infront of Web Servers? — 夏期劇場, Jan 11 '16 at 01:11

score 8 · Answer 3 · answered Oct 13 '17 at 08:14

8

Since October 10th 2017 it's possible to do this with Application Load Balancer. You can bind multiple certificates to the same secure listener on your load balancer and ALB will automatically choose the optimal TLS certificate for each client. For more information see: https://aws.amazon.com/blogs/aws/new-application-load-balancer-sni/

answered Oct 13 '17 at 08:14

jjanzic

585
5
8

This is an excellent option for scenarios requiring 25 or fewer certificates. With the added benefit of being able to offload SSL termination. – Garth Kerr Oct 27 '17 at 03:57

score 0 · Answer 4 · answered Sep 06 '17 at 11:41

I agree with the above answer for Nginx by Garth Kerr.

In case of Apache:

You can terminate SSL certificates either at ELB or Apache/Nginx(server) level

In case of multi-tenant(multi-client) architecture, we may need to support different customers(with different domains - *.abc.com, *.xyz.com) under a single ELB, which will not work in an existing ELB setup.

Solution: You can do this by adding listeners in ELB like below: TCP 443 (instead of HTTPS - 443) - this will pass through the 443 requests Then, you can terminate the SSL certificates at the server level

You have to purchase the certificate from external vendors (like GoDaddy) and install & terminate the certificates at the server level.

E.g., Apache virtual host looks like

NameVirtualHost *:443
<VirtualHost *:443>
        ServerName abc.com

        ####abc HTTPS Certificate
        SSLEngine on
        SSLCertificateFile /opt/organization/site/ssl_keys/abc/abc_gd.crt
        SSLCertificateKeyFile /opt/organization/site/ssl_keys/abc/abc.pem
        SSLCertificateChainFile /opt/organization/site/ssl_keys/abc/abc_gd_bundle.crt

        WSGIScriptAlias / /opt/organization/site/deployment-config/abc.wsgi

        ServerSignature On
        Alias /media/ /opt/organization/site/media/
        <Directory /opt/organization/site/media/>
        Order deny,allow
        Allow from all
        </Directory>
</VirtualHost>

NameVirtualHost *:80
<VirtualHost *:80>
        ServerName abc.com

        #Rewrite to HTTPS in case of HTTP
        RewriteEngine On
        RewriteCond %{SERVER_NAME} abc.com
        RewriteCond %{HTTP:X-Forwarded-Proto} !https
        RewriteRule . https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

        WSGIScriptAlias / /opt/organization/site/deployment-config/abc.wsgi
        ServerSignature On
        Alias /media/ /opt/organization/site/media/
        <Directory /opt/organization/site/media/>
        Order deny,allow
        Allow from all
        </Directory>
</VirtualHost>

Can I use Single AWS ELB to host 2 SSL Certs for 2 Different Domains?

4 Answers4