Default SSL Certificates

Question

I'm moving from another cloud provider. I am currently just testing a default environment that has a URL similar to this:

http://example-env-1.us-east-1.elasticbeanstalk.com

I am trying to get SSL / HTTPS to work for this address. Then I plan to use CNAME to redirect to this address and ultimately completely move the name servers.

However, after everything is still successfully installed, I get to add the certificates, and it just says “failed”:

And even though my actual certificate "example.com" ssl, successfully issued, does not appear in the drop-down list of the load balancer selection (and yes, I updated):

How to enable SSL using certificate manager?

Answer 1

This is because you are trying to request a certificate for the elasticbeanstalk.com domain. You will not be able to get a certificate for this domain because you do not own it :). You also cannot set https for the standard domain bean blocks that they give you.

You must use ACM to obtain a certificate for your custom domain, which you plan to do for the CNAME record.

Example:

If you must own, tell the domain amyneville.com . You can create a certificate through ACM for this domain.

If you use your own domain, you do NOT need to get a certificate for the elasticbeanstalk.com domain.

A couple more things:

You cannot create a CNAME record on TLD ( amyneville.com ). You can create a CNAME record for www.amyneville.com . Therefore, if you want to use the CNAME approach, you will need to create a non-www redirect to www. .

But better than CNAME would use record A and point it to the elastic beanstalk resource that was configured. So the load balancer that was created for you uses the A record.

Last but not least, you cannot apply the ACM certificate through the elastic beanstalk console. Instead, you have to use AWS CLI tools. Here's a link on how to do this: fooobar.com/questions/556348 / ...

Answer 2

I searched for it myself and found this useful blog from one of the Amazon teams ...

https://medium.com/@arcdigital/enabling-ssl-via-aws-certificate-manager-on-elastic-beanstalk-b953571ef4f8#.frcj0rj4t

While you cannot use the console to select a certificate, as indicated in your question, you can use the CLI Elastic Beanstalk to install the certificate on the one you created in the certificate manager.