Question

我试图在我的单个实例上使用SSL。我认为我设法正确生成了密钥和证书，经过一番探索后，我设法找到配置实例的指令以使用它。

所以我在顶级目录中创建了一个.ebextensions文件夹，里面有一个名为singlessl.config的文件

我已将下面的文件与我上传的文件完全相同。它没有用，有谁知道错误是什么？

（至少发生了一些事情，因为现在我收到了“无法连接”消息）

无论如何，我已经用其他字符替换了一些像键一样的字符串，但除此之外它完全相同

环境是没有负载均衡器的单个实例Node.js，这里是文件：

Resources:
    sslSecurityGroupIngress: 
        Type: AWS::EC2::SecurityGroupIngress
        Properties:
            GroupName: {Ref : awseb-e-10randchar-stack-AWSEBSecurityGroup-NOW13RANDCHARS}
            IpProtocol: tcp
            ToPort: 443
            FromPort: 443
            CidrIp: 0.0.0.0/0

files:
    /etc/nginx/conf.d/ssl.conf:
        mode: "000755"
        owner: root
        group: root
        content: |
            # HTTPS server

            upstream nodejs {
            server 127.0.0.1:8443;
            keepalive 256;
            }

            server {
                    listen       443;
                    server_name  localhost;

                    ssl                  on;
                    ssl_certificate      /etc/pki/tls/certs/server.crt;
                    ssl_certificate_key  /etc/pki/tls/certs/server.key;

                    ssl_session_timeout  5m;

                    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
                    ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
                    ssl_prefer_server_ciphers   on;

                    location / {
                            proxy_pass  http://nodejs;
                            proxy_set_header   Connection "";
                            proxy_http_version 1.1;
                            proxy_set_header        Host            $host;
                            proxy_set_header        X-Real-IP       $remote_addr;
                            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                    }
            }
    /etc/pki/tls/certs/server.crt:
        mode: "000400"
        owner: root
        group: root
        content: |
            -----BEGIN CERTIFICATE-----
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificatethisisno
            Thisisnotmyactualcertificatethisisnotmyactualcertificate
            -----END CERTIFICATE-----

    /etc/pki/tls/certs/server.key:
        mode: "000400"
        owner: root
        group: root
        content: |
            -----BEGIN RSA PRIVATE KEY-----
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmyactualkeythis
            Thisisnotmyactualkeythisisnotmyactualkeythisisnotmya
            -----END RSA PRIVATE KEY-----

我不确定我的错误。任何见解都会有所帮助吗？

Answer 1

是。在单实例上配置SSL比使用loadBalance设置ElasticBeansTalk并定义max instances = 1

更难

简单来说，步骤在http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https.html

Answer 2

请记住，缩进在此文件中非常重要。
我刚刚在这个文件中完成了配置，我很难正确缩进所有内容。
此外，请记住，当您使用负载均衡器时，您每月花费约18美元。如果您不介意在预算中使用此功能，我建议您使用负载均衡器。
还有一件事，如果您使用的是VPC，则需要将 GroupName 属性更改为 GroupId

Answer 3

这是一个简单的配置文件，可以在单个实例Elastic Beanstalk服务器上自动安装免费的LetsEncrypt证书。

http://bluefletch.com/blog/domain-agnostic-letsencrypt-ssl-config-for-elastic-beanstalk-single-instances/

它基本上使用容器命令来下载certbot，获取证书并配置nginx。证书的域名来自一个env变量，所以它可以在没有从一个服务器到下一个服务器的大量调整的情况下使用。

Elastic Beanstalk单实例SSL .ebextensions配置文件无法正常工作

3 个答案: