AWS负载平衡器背后的SSL证书

Question

我有一个在AWS上运行的项目。结构如下：

Application Load Balancer:
    - EC2 AutoScaling Group [1-5]:
      - 1^ instance...
      ... (more spawned when needed)
      - 5^ instance...

我已使用AWS证书管理器为负载平衡器创建了一个证书。所以现在的流量是：

Clients ---- HTTPS Port 443 ----- > Load Balancer ------ HTTP Port 80 ----> EC2 Instances

但由于加载网页时实例上没有证书，因此会收到“站点不安全”警告。

如何创建从客户端到负载均衡器后面的任何实例的完整SSL连接？

编辑

以下是nginx配置（适用于所有实例）

server {
listen       80;
server_name  marette.ovh www.marette.ovh;

root /home/marette/marette_backend/dist;
index index.html index.htm;

client_max_body_size 10M;
error_page 502 /gateway.html;


location / {
   
    add_header 'Access-Control-Allow-Origin' "*" always;
    add_header 'Access-Control-Allow-Credentials' 'true' always;
    add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
    add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
   
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;
    proxy_redirect off;
    proxy_read_timeout 30s;
    proxy_send_timeout 30s;

    root /home/marette/marette_backend/dist;
    try_files $uri $uri/ /index.html;
}
    error_log  /var/log/nginx/vue-app-error.log;
access_log /var/log/nginx/vue-app-access.log;


# this is for the REST backend
location /api {
    add_header 'Access-Control-Allow-Origin' "*" always;
    add_header 'Access-Control-Allow-Credentials' 'true' always;
    add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
    add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
                        # required to be able to read Authorization header in frontend
    add_header 'Access-Control-Expose-Headers' 'Authorization' always;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 30s;
    proxy_send_timeout 30s;      
    proxy_pass https://127.0.0.1:8000/api;
   }

}

Answer 1

应执行的检查：

• 始终检查SSL的域名是否正确，如果无效，则会收到证书错误。
• 验证侦听器是否正确配置为使用HTTPS侦听443，并且SSL是否有效。
• 验证目标组正在为服务器本身使用正确的协议和端口（不需要与负载均衡器相同）。

一个测试SSL问题的好站点是使用SSL实验室