Search code examples
amazon-web-serviceshttpsamazon-route53

Front, backend https with one ACM, frontend is okay, but backend also https and htttp


One ACM was issued to *.example.com. With this, it was applied to public route 53 called example.com as CNAME, and two load balancers were connected using it. The two load balancers ran front and back-end services, respectively.

However, the problem is that the frontend was applied with https, but the backend was not applied.

The domain of the backend is, for example, api.example.com, which was accessible to both http and https.

I redirected HTTP 80 to HTTPS 443 on the back-end load balancer, but why didn't it apply?

The front end is redirected to https even if it is accessed through http.

Record A was given 'api.example.com' and the backend load balancer is equally http 80 redirect https 443.

However, if you access through http, you can see a server that does not display ssl authentication, and if you access through https, you can see a server that shows ssl authentication.

Naturally, it was set to 80 redirect 443 forward.


Solution

  • Check the backend load balancer if it has an SSL cert associated with it.

    When you associate Route53 with an ACM SSL cert, it only validates the ownership of the domain. Route53 is a DNS service, it does not participate in SSL encryption. It is the load balancer's job in your topology.

    Also, you can use an Alias record instead of CNAME to route to load balancers deployed on AWS; then the Route53 DNS calls are free. (I was not sure whether the CNAME record you mentioned was the actual routing record or just the validation one, so decided to mention that.)