ELB and Apache configuration for HTTPS website

Question

I'm setting up ELB for a https website and I have questions concerning the ports configuration...

Right now I have this port configuration on the ELB:

• 80 (HTTP) forwarding to 80 (HTTP)
• 443 (HTTPS) forwarding to 80 (HTTP)

And on my instance I have this Apache configuration:

• requests to *:80 redirected to https://www.mywebsite
• *:443 configured

Apparently it's working but is it the right way to do?

Thank you for your help

Celine

PS: When I started to configure the ELB I indicated 443 forwarding to 443 but then I had to answer strange questions for the authentication...

Answer 1

The configuration as described in the question didn't work because it created a never ending redirection: 443(ELB) forwarding to 80(Apache) forwarding to 443(ELB) forwarding to 80(Apache) forwarding to 443(ELB), etc.

So, I modified the ELB configuration to have:

• 443 (HTTPS) forwarding to 443 (HTTPS)
• 80 (HTTP) forwarding to 80 (HTTP)

When I created the listener 443 (HTTPS) forwarding to 443 (HTTPS), I didn't get to answer questions concerning the authentication. When I look on the ELB description I can see "Backend Authentication: Disabled"

The Health Check is done on HTTPS:443

(I also modified the instance security group: only the load balancer can access the instance on ports 80 and 443)

Update:

Another solution is to have only port 80 open on the instance:

• 80 (HTTP) forwarding to 80 (HTTP)
• 443 (HTTPS) forwarding to 80 (HTTP)

but to use X-Forwarded-Proto to determine if the client used HTTP or HTTPS and forward to HTTPS only if X-Forwarded-Proto = http

Example with Apache:

<VirtualHost *:80>
    ...
    RewriteEngine On
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteCond %{HTTP_USER_AGENT} !^ELB-HealthChecker
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
    ...
</VirtualHost>

The line RewriteCond %{HTTP_USER_AGENT} !^ELB-HealthChecker has been added so the ELB check is not redirected. See https://serverfault.com/questions/470015/how-should-i-configure-my-elb-health-check-when-using-namevirtualhosts-and-redir for other solutions concerning the health check

AWS Documentation concerning X-Forwarded-Proto: http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/x-forwarded-headers.html#x-forwarded-proto