1

Is it possible for a single domain name to be associated with multiple AWS ELB on different domains?

Eg. I want example.com to point to my first ELB, and api.example.com to point to my second ELB (which is from a different AWS account).

I tried creating an A record for example.com with the first ELB as alias target, and another A record for api.example.com with the second ELB as alias target, but only example.com is working.

For both of the ELB, I use the same domain name for the AWS cert manager to register for SSL cert, not sure if that affects anything.

Avery235
  • 4,756
  • 12
  • 49
  • 83
  • How can you create an alias target to an ELB in another account? Please define what isn't working exactly. What is the error in the web browser when you try to go to the api domain? – Mark B Dec 12 '17 at 01:55
  • @MarkB error is `ERR_CONNECTION_TIMED_OUT`. See the answer below on how to create an alias target to an ELB in another account. – Avery235 Dec 12 '17 at 12:15
  • Does the security group assigned to the second ELB allow incoming traffic? Does the ELB console list at least one instance as healthy? SSL certificate should be irrelevant at this point, since you aren't even connecting to the ELB yet. – Mark B Dec 12 '17 at 13:22
  • @MarkB oh right, totally forgot about ELB's security group! Thanks for the help! – Avery235 Dec 12 '17 at 13:39

2 Answers2

1

The problem was that I forgot to allow all incoming traffic on the security group of the ELB...

Avery235
  • 4,756
  • 12
  • 49
  • 83
0

Yes, you can use multiple load balancers for the same domain or different domains. For the AWS managed SSL certificate, you will need all domain names in the same certificate or you can use a different SSL certificate for each domain name. I would just create one certificate with "example.com" and "*.example.com".

Your issue is that you are using an SSL certificate for api.example.com that has the name example.com. The SSL certificate must include the name that matches the domain name.

If you do not have an SSL certificate installed on the EC2 instance, then setup SSL termination at the load balancer. This means creating a listener for port 443 that forwards to port 80.

To configure Route53 with an ELB in a different account:

For ELB load balancers, do one of the following:

  • If you used the same account to create your Amazon Route 53 hosted zone and your load balancer – Choose Alias Target and choose a load
    balancer from the list. If you have a lot of load balancers, you can
    type the first few characters of the DNS name to filter the list.
  • If you used different accounts to create your Amazon Route 53 hosted zone and your load balancer – Enter the value that you got in the procedure Getting the DNS Name for an ELB Load Balancer.
  • If you used one AWS account to create the current hosted zone and a different account to create a load balancer, the load balancer will
    not appear in the Alias Targets list.
  • If you used one account to create the current hosted zone and one or more different accounts to create all of your load balancers, the Alias Targets list shows No Targets Available under Elastic Load Balancers.

In either case, the console prepends dualstack. to the DNS name. When a client, such as a web browser, requests the IP address for your domain name (example.com) or subdomain name (www.example.com), the client can request an IPv4 address (an A record), an IPv6 address (a AAAA record), or both IPv4 and IPv6 addresses (in separate requests). The dualstack. designation allows Amazon Route 53 to respond with the appropriate IP address for your load balancer based on which IP address format the client requested.

Values for Alias Resource Record Sets

John Hanley
  • 74,467
  • 6
  • 95
  • 159
  • I have changed the first ELB to use a cert with `example.com`, and the second ELB to use a cert with `api.example.com`, it still doesn't work. The error given by browser is `ERR_CONNECTION_TIMED_OUT` – Avery235 Dec 12 '17 at 12:13
  • Do both HTTP and HTTPS timeout or only HTTPS? – John Hanley Dec 12 '17 at 14:25
  • was caused by security policy issue, thanks for the help on fixing the cert issue though! – Avery235 Dec 12 '17 at 14:45