Search code examples
flasknginxamazon-ec2ssl-certificate

SSL installation Nginx EC2 Ubuntu Flask API

  1. deployed flask on AWS EC2 on Gunicorn and Nginx and working fine with HTTP
  2. to install ssl, got the sertificate and key files
  3. updated the nginx conf file to
server {
          listen 443 ssl;
          ssl_certificate /home/ubuntu/ssl/cert.pem;
          ssl_certificate_key /home/ubuntu/ssl/key.pem;
          server_name 172.31.27.55;
          access_log /var/log/nginx/access.log;
          error_log /var/log/nginx/error.log;
          location / {
          include proxy_params;
          proxy_pass http://127.0.0.1:5000;
          }       
      }

where : 172.31.27.55 is the IP of the server

when I am calling the GET API using http getting the response without any issue 
http://ec2-54-190-34-8.us-west-2.compute.amazonaws.com:5000/-data/languages

but, getting an error when calling it with HTTPS
https://ec2-54-190-34-8.us-west-2.compute.amazonaws.com:5000/-data/languages

I have tried keeping server_name value to _(only underscore) but same error

EC2 inbound rule looks like enter image description here

Solution

  • Try this code.

    mentioning ssl_session_timeout is also important

    server {
        listen 443 ssl;
        server_name _;
        root /usr/share/nginx/html;
        ssl_certificate /home/ubuntu/ssl/cert.pem;
        ssl_certificate_key /home/ubuntu/ssl/key.pem;
        ssl_session_timeout 10m;
    
        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;
      
        location / {
         include proxy_params;
         proxy_pass http://127.0.0.1:5000;
       }       
     }

    The server_name directive is set to 172.31.27.55, which means this configuration block will only respond to requests made to that IP address.

    If you intend to use a domain name, make sure to replace 172.31.27.55 with the actual domain name.

    if no domain name needs to mention then just keep _ (underscore)

    remove port no 5000 from url and check.. its working .. you dont need to mention port number 5000 as you are making it proxy