1. Home
  2. Training Library
  3. Networking & Content Delivery (DVA-C01)

SSL Server Certificates

Start course
Overview
Difficulty
Beginner
Duration
50m
Description

This course provides detail on the AWS Networking and Content Delivery services relevant to the Developer - Associate exam.

Want more? Try a lab playground or do a Lab Challenge!

Learning Objectives

  • Understand the basics of APIs
  • Learn about HTTP and internet communication
  • Understand the difference between HTTP and REST
  • Understand what types of APIs API gateway can create
  • The general differences between those API types
  • How an API gateway functions at a high level
  • Give you an understanding of Amazon CloudFront and its high-level process of operation
  • Understand what an elastic load balancer is and what is used for
  • Be aware of the different load balancers available to you in AWS
  • Understand how ELBs handle different types of requests, including those that are encrypted
  • Be able to identify the different components of ELBs
  • Know how to configure ELBs 
  • Know when and why you might need to configure an SSL/TLS certificate

 

Transcript

Hello and welcome to this short lecture which will provide a high-level overview of server certificates and how they are used within your elastic load balancers. 

As I mentioned in the previous lecture the Application Load Balancer provides a flexible feature set for your web applications running the HTTP or HTTPS protocols. As such, the ALB listener options available when creating your ALB are either the HTTP or HTTPS protocol on port 80 and 443 respectively. Configuration of your HTTP port 80 listeners is a fairly process and I'll cover this in the next lecture. However, there will times when you would need to use the HTTPS encrypted protocol as a listener and this requires some additional configuration. 

So let me run through some of the points when using HTTPS as a listener. HTTPS is an encrypted version of the HTTP protocol and this allows an encrypted communication channel to be set up between clients initiating the request and your Application Load Balancer. However, to allow your ALB to receive encrypted traffic over HTTPS it will need a server certificate and an associated security policy. 

SSL or Secure Sockets Layer, to give it its full name, is a cryptographic protocol, much like TLS, Transport Layer Security. Both SSL and TLS are used interchangeably when discussing certificates for your Application Load Balancer. The server certificates used by the ALB is an X.509 certificate, which is a digital ID that has been provisioned by a Certificate Authority and this Certificate Authority could be the AWS Certificate Manager service also known as ACM. This certificate is simply used to terminate the encrypted connection received from the remote client, and as a part of this termination process the request is then decrypted and forwarded to the resources in the ELB target group. 

When you select HTTPS as your listener, you will be asked to select a certificate using one of four different options available. Either choose a certificate from ACM, upload a certificate to ACM, choose a certificate from IAM, or upload a certificate to IAM. The first two options relate to ACM. An ACM is the AWS Certificate Manager and this service allows you to create and provision SSL/TLS server certificates to be used within your AWS environment across different services. This integration with ACM simplifies the configuration process of implementing a new certificate for your elastic load balancer and as a result, it's the preferred option. 

The last two options allow you to use a third-party certificate by using IAM as your certificate manager and you would select this option when deploying your ELBs in regions that are not supported by ACM. For a list of supported regions, please see the following link. For detailed information on how to upload, retrieve, and list server certificates via IAM, please see the following AWS documentation. Using ACM as your certificate manager allows you to both create certificates from within ACM itself and also import existing certificates created from outside of AWS adding additional flexibility for your current third party certificates. The configuration of ACM is out of scope for this course. However, you can find further information on this service using the following link

Now it's brought me to the end of this lecture. In the next few lectures I shall be looking at the configuration of each of the defined load balancers, application, network, and classic, to provide you with more information on their components starting with the Application Load Balancer, the ALB.

About the Author
Avatar
Will Meadows
Senior Content Developer
Students
6055
Courses
31

William Meadows is a passionately curious human currently living in the Bay Area in California. His career has included working with lasers, teaching teenagers how to code, and creating classes about cloud technology that are taught all over the world. His dedication to completing goals and helping others is what brings meaning to his life. In his free time, he enjoys reading Reddit, playing video games, and writing books.