Comments for Set up SSL

Chapter Comments
21

From @hutualive on Thu Aug 03 2017 08:23:49 GMT+0000 (UTC)

@jayair
two comments:
1.the certificate can be selected from the dropdown list of cloudfront, is only available to be created in us-east-1 region(N.Virginia), create from other region is not working.
2.for bare domain(example.com),suggest for the viewer policy to use redirect http to https, which is less confusing and better for the security purpose. because when we hitting www.example.com, will auto redirect to https://example.com, but when we hitting example.com, it will stay as is unless people specify https://example.com, which is not normal case.

thanks for your great tutorial : )

22

From @jayair on Thu Aug 03 2017 17:24:45 GMT+0000 (UTC)

@hutualive good point on the certificate region issue. Added a note.

For the bare domain, we do ask people to redirect HTTP to HTTPS. It’s one of the steps in the chapter.

23

From @littleredshack on Tue Dec 12 2017 22:26:12 GMT+0000 (UTC)

There is a second step in AWS Certificate Manager to validate either via DNS or email:

image
33911785-8c63866a-dfe7-11e7-9fae-b036c963181f.png1524×748 83 KB

image
33911807-a6f2e868-dfe7-11e7-885e-2126ce6bf6c0.png1652×419 27.4 KB

24

From @jayair on Fri Dec 15 2017 17:00:49 GMT+0000 (UTC)

@littleredshack Did you do the CNAME record in place of the email validation?

25

From @littleredshack on Sat Dec 16 2017 02:55:19 GMT+0000 (UTC)

Yes. There was an option to allow AWS to update the DNS and I just clicked on that

26

From @jayair on Sun Dec 17 2017 22:50:47 GMT+0000 (UTC)

@littleredshack I see. Yeah we might cover that option in the future.

27

From @BIWhitfield on Tue Feb 20 2018 14:13:35 GMT+0000 (UTC)

Hi guys, great tutorial! One of my only issues was that when I set up the validation in this section by email, it sent validation emails to 5 common email addresses associated with the domain I bought from Route 53. However I can’t for the life of me work out how to access those emails to approve the validation. As far as I can tell the Route 53 domain doesn’t support email forwarding and I can’t find an inbox area to validate. I’ve ended up clearing out the validation by email and doing the DNS way. Just waiting on that to refresh (30 mins apparently) so I can finish the https part of that chapter.

Any ideas where those emails go just for my own reference?

28

From @jayair on Fri Feb 23 2018 21:43:58 GMT+0000 (UTC)

@BIWhitfield Honestly I’m not entirely sure. I think it goes to what Route53 thinks is associated with your domain?

We should change the tutorial to use the DNS way instead, it’s far more reliable.

29

My notes app is hosted in a different region (not US East, N.Virginia). I am using Certificate Manager for the first time. However, I don’t see the option to get started in the Certificate Manager home page.

Further, when I try to provision a certificate, I see 4 steps on the left versus the three listed in the tutorial. Further, in the validation screen, I am not able to expand the domains. I am not sure if I should go ahead and request the certificate. Has someone faced something similar? Thanks for any help.

30

I think Certificate Manager is for certain specific regions.

Can you post a screenshot for the options you are seeing in the console?

31

This is by far the best resource I found on deploying SPA to aws.
Kudus!

I have one question: Is there a way to prevent users using the static website hosting URL (I want to prevent it since it’s not https)?
If they enter via CF then using the ssl works fine, but what happens when they access the “bucket” directly?

1 Like
32

Hmm but aren’t the S3 bucket URLs https by default? Or are you saying what would happen if they access it via http?

33

they aren’t HTTPs.
based on the picture you uploaded look at the address:
https://d33wubrfki0l68.cloudfront.net/531d2323dc0fe8130a792a126a263af26372cef8/9aded/assets/edit-static-web-hosting-properties.png

edit-static-web-hosting-properties.png2784×1770 289 KB

34

Yeah I’m not entirely sure how you would hide it, aside from obscuring it.

35

Nothing works… :frowning:

I buy the domain my-serverless-app.uk and I did all the steps of this tutorial but my domain doesn’t work… I get the error: cannot find the ip address for http://my-serverless-app.uk.

Domain
Domain.PNG1185×480 48.6 KB

The CloudFront works with the URL http://d212vehw36zju1.cloudfront.net

The bucket works with the URL http://notes-app-client-jdccr.s3-website-us-east-1.amazonaws.com

Other screenshots of my configuration here:

1
1.PNG793×80 3.16 KB

2
2.PNG1178×250 30.1 KB

3
3.PNG929×458 24.6 KB

36

One of the issues with the domain configuration is that if you make a mistake it takes a while for the fix to take effect. Are you still having this issue?

Edit: I see the link doesn’t work. From the screenshots it looks like it is configured properly. But when I $ping my-serverless-app.uk it doesn’t work. It seems like the domain is not pointing to anything?

37

Hello @jayair . The problem is still there… :frowning:

38

Yeah it looks like it. Can you try pointing the domain to something else? It seems like it just isn’t pointing to anything. Everything else in your setup seems fine.

39

Hi,

I recently went through this step again - I did the first time in ~Feb. Since then, I noticed a change. It appears that you have to create the certificate in ACM before you can give a CloudFront distribution an alternate CNAME. If you try to create the CNAME first, CloudFront fails with:

52%20PM
Screen Shot 2019-04-09 at 8.16.52 PM.png1262×464 54.6 KB

I swapped the order of the steps - I created the cert first and then the CNAME, and everything works fine.

I was able to follow the steps in this chapter exactly in ~Feb, so I think this is a relatively recent change on amazon’s side.

1 Like
40

I see. Thanks for letting us know. I’ll take a look at this when we update this chapter.