HTTPS is HTTP inside TLS: the traffic is encrypted, and the server proves its name with a certificate, signed by an authority the browser trusts. The certificate lists the names it covers; *.monstermarket.example covers www.monstermarket.example but not the apex itself.

If the name you asked for is not on the certificate, curl stops with exit 60: SSL: no alternative certificate subject name matches target host name. curl -sk https://$DNS/ skips the check, for a quick test, never in scripts.

A certificate from ACM

AWS Certificate Manager issues public certificates free and renews them while they are in use, as long as the validation records stay in the zone. By default its public certificates stay inside AWS, used by load balancers and CloudFront (an exportable one, to install on a server yourself, costs extra), and certificates you import are not renewed for you. DNS validation proves you control each name:

CERT=$(aws acm request-certificate --domain-name monstermarket.example --subject-alternative-names www.monstermarket.example --validation-method DNS --query CertificateArn --output text)

aws acm describe-certificate --certificate-arn $CERT --query "Certificate.DomainValidationOptions[].ResourceRecord.[Name,Value]" --output text

Each line is a CNAME to UPSERT into the public zone (a change batch, as before). About a minute after they resolve on the internet, aws acm describe-certificate --certificate-arn $CERT --query Certificate.Status --output text turns from PENDING_VALIDATION to ISSUED.

Certificates are regional: a load balancer uses one from its own region, and CloudFront only one from us-east-1.

HTTPS on the load balancer

With the load balancer's ARN in LB and its target group's in TG (as in Chapter 6), and its security group allowing 443, a listener with the certificate:

aws elbv2 create-listener --load-balancer-arn $LB --protocol HTTPS --port 443 --certificates CertificateArn=$CERT --default-actions Type=forward,TargetGroupArn=$TG

The HTTP listener, HTTP=$(aws elbv2 describe-listeners --load-balancer-arn $LB --query "Listeners[?Protocol=='HTTP'].ListenerArn" --output text), stops serving and sends visitors to HTTPS:

aws elbv2 modify-listener --listener-arn $HTTP --default-actions 'Type=redirect,RedirectConfig={Protocol=HTTPS,Port=443,StatusCode=HTTP_301}'

curl -sIL http://monstermarket.example/ shows the 301 with its Location, then follows it (-L).

Names on a distribution

A distribution answers for another name only if that name is in its Aliases and a us-east-1 certificate covers it. With sni-only, the browser names the site in its first message, so one address can serve many certificates. A distribution changes through its whole configuration and the ETag of the version you read:

aws cloudfront get-distribution-config --id $DIST --query DistributionConfig > dist.json

With nano, replace the two blocks in dist.json (the whole ViewerCertificate, so CloudFrontDefaultCertificate and CertificateSource go; TLSv1.2_2021 is the oldest TLS version viewers may use):

"Aliases": { "Quantity": 1, "Items": ["www.monstermarket.example"] },
"ViewerCertificate": { "ACMCertificateArn": "CERT-ARN",
  "SSLSupportMethod": "sni-only", "MinimumProtocolVersion": "TLSv1.2_2021" }

ETAG=$(aws cloudfront get-distribution-config --id $DIST --query ETag --output text) keeps the version:

aws cloudfront update-distribution --id $DIST --distribution-config file://dist.json --if-match $ETAG

An old ETag is PreconditionFailed. Last, an alias record for www to the distribution's domain name (zone Z2FDTNDATAQYW2).