Security – 403 forbidden error going through aws load balancer

1. Your web server has to do all the SSL/TLS processing. It means more load on the web server, but you have full control over the certificates and end-to-end security.

2. Your web server can serve everything as normal web pages, offloading the SSL/TLS processing. Considerably lower load on the web server, but you don't control the certificates yourself any more and break end-to-end security.

In the end it comes down to if you trust the security of the load balancer and the network between load balancer and web server. If not, don't bother. Note that if you are running credit card transactions or something similar there are a some rather strict rules about when you may send the data unencrypted from SSL/TLS offloading to your server. Moving the certificate is not really a security advantage (somebody breaking into your web server is going to get all the data, regardless of if they can steal your certs or not).

Do you have such an overhead from SSL/TLS that you really need to offload it to external hardware?

Typically you can setup the offloading system to only provide SSL/TLS security where it is really needed.

concatenate the files provided manually, in the following order:

• site.com.crt
• intermediate.crt (one or more, the order of these doesn't matter)
• ROOT.crt

you can do this from a shell with the cat command

cat site.com intermediate.crt ROOT.crt > site.chain.pem

or copy/paste them, no whitespace between, make sure certificates are on different lines

-----BEGIN CERTIFICATE-----
site cert
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
intermediate cert
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
root cert
-----END CERTIFICATE-----