Attach SSL to Elastic Load Balancer (ELB) and enable HTTPS
Tags: aws, devops
Published: 2020-04-07 07:16:04

---
series: DevOps for Frontend Engineers
---
HTTPS enables you to transfer data over the network securely. To be able to use HTTPS with your load balancer you need to do the following steps:

1. Request a certificate
2. Add a CNAME record
3. Attach HTTPS listener to the load balancer

#### 1. Request a certificate
From AWS console, go to "Certificate Manager".
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/yznnkbsu6m251nsmry85.png)

It will take you to the homepage of the AWS Certificate Manager. Select Provision Certificate and click "Get started".
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/5dwudxjq3x5rrdfeavaj.png)

Choose "Request a public certificate" and click on the "Request a certificate" button.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/ckxap0jsgzf6meuittj9.png)

Enter the domain name you are using with your load balancer and click next. If you are using a sub-domain, you will have to enter that sub-domain. Also, you can cover more than one domain in a single certificate like this:

```
whateverdomain.club
my.whateverdomain.club
abc.whateverdomain.club
```

or to cover all the sub-domains, you have to use

```
*.whateverdomain.club
whateverdomain.club
```

Select "DNS Validation" ([learn why](https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-validate-dns.html)) and click "Next"
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/56e9llip2gy9x5br6sa0.png)


You can add tags if you want, otherwise, leave them empty and click "Review". On the review page, review the info and click "Confirm and Request". Click "Export DNS configuration to a file" (it will download a csv file) and click "Continue".
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/yjyealengtz2ozztuh4p.png)

Now we need to validate our request (prove that we are authorized to request SSL certificates for our domain). Until the validation is completed you will see "Pending validation" status against the certificate request.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/hhbvuvlbtvna4spmksuk.png)


#### 2. Add a CNAME record
To prove our authorization we need to add the CNAME record to our domain's DNS records. To do that go over to route 53 (if your domain's NS are not pointing towards AWS then you will have to do the following steps from your domain registrar's control panel or some other service that you are using).
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/4vobgl37mwlyfn8shrdr.png)

Select the Hosted Zone for the domain in question.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/j312rv62g33w6mydfwpn.png)

Click "Create record set", open up the csv file that was downloaded earlier and enter the values accordingly:

`Name` = From csv's Record Name column
`Type` = CNAME - Canonical name
`Alias` = No
`Value` = From csv's Record Value column 

After entering the values click "Save Record Set".

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/t6dhx9x9spq66lpjhzbp.png)

*Note: in the CSV file, the Record Name is completely written, you just need the random string part.

```
# value in csv
_ab1e89753de00b10b8de785149740feb.whateverdomain.club. 

# value you need to enter in the name field
_ab1e89753de00b10b8de785149740feb

```

Once the CNAME record has been added (correctly), go back to the AWS Certificate Manager and look for the status. It should be changed to "Issued".
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/vo258ghkuqukx67iplpz.png)

*Note: The status change can take 0-72 hours. However, if ACM (AWS Certificate Manager) is not able to validate within 72 hours, then you will see "Time out" as the status and you will have to regenerate the request.

#### 3.Attach HTTPS listener to the load balancer
Now that we have successfully generated an SSL certificate for our domain, we are ready to attach HTTPS listener to the load balancer. Head over to EC2, from the bottom left section select "Load Balancers". Select the load balancer to whom you intend to attach the SSL. Go the "Listeners" tab from the bottom and click "Add listener".
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/c1nhnbieofl5ienwqthv.png)

Select "HTTPS" as protocol. Add default action "Forward to" and select the target group to which you want to forward your requests. Leave "Security Policy" as it is. Select the certificate we generated above in the "Default SSL certificate".
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/podtsvzln04u4n7pw5vb.png)

Once the listener has been attached, go back to the load balancer page. From the bottom left select "Security Groups".
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/34dk5n50710kr8syjjp0.png)

Select the security group attached to the load balancer.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/i4t523wnbilm4bsppeg1.png)

Click "Edit inbound rules".
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/msggj62rl838kid4loz2.png)

Click "Add Rule". From the "Type" dropdown, select `HTTPS`. From the source select `0.0.0.0/0`. Add another rule, pick `HTTPS` as the type but `::/0` as the source. Click "Save rules".
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/v6tge10cjxjairnekily.png)

That's it. Go to your browser, navigate to your domain and `https` as the protocol to confirm the set-up.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/qjujpmcztipm54i3ia98.png)