Ssl – How to use https with AWS Cloudfront without paying $600 to upload the cert

amazon-cloudfrontamazon-elbhttpsssl

I can host a dynamic website through Amazon CloudFront because they have CNAME Wildcard Support. However, some pages of my Site use HTTPS. Amazon have some documentation about how to associate your SSL certificate with a CloudFront distribution but the pricing shows that it costs $600 per month, too much for me.

My question is… is it possible to configure CloudFront so HTTP requests are served from CloudFront but HTTPS requests are ignored by CloudFront and passed directly to the origin (in my case, a Elastic Load Balancer which can decrypt SSL at no extra cost)?

Best Answer

As of March 2014, Amazon CloudFront supports SNI, at no additional cost, see details here.

This will allow you to use your ssl certificate on CloudFront, without paying $600 monthly.

Please note that SNI is not supported by (extremely) old browsers (pre-IE7, pre-Chrome6, pre-FF 2), see details in link above.

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

SSL & Load Balancing

No, you can't associate multiple SSL certificates because each SSL certificate requires it's own IP address (SNI? Hah!) and you can only associate one IP address with each ELB.

Best Answer

Related Solutions

NGINX Redirect – How to Rewrite All HTTP Requests to HTTPS While Maintaining Sub-Domain

Correct way in new versions of nginx

SSL & Load Balancing

Related Topic