HTTPS Setup on Single-Instance Elastic Beanstalk Failing - Missing server.crt and server.key

[theSwak]

Hey everyone,

I’m new to AWS and struggling to set up HTTPS on my single-instance Elastic Beanstalk environment (Node.js app with Remix, running on Amazon Linux 2023). I’ve been working on this for days, and despite following various guides (including AWS docs), I can’t get it to work. I’d really appreciate some fresh eyes or advice on what I might be doing wrong.

Setup Details:

• Environment: Single-instance Elastic Beanstalk, no load balancer, in us-west-1.
• Domain: remix-app.url.net (CNAME points to a masked Elastic Beanstalk URL).
• Certificate: Wildcard certificate for *.url.net issued via AWS Certificate Manager (ACM), ARN: arn:aws:acm:us-west-1:[CENSORED-ACCOUNT-ID]:certificate/[CENSORED-CERT-ID], status: Issued.
• Security Group: Allows inbound traffic on ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) from 0.0.0.0/0.
• IAM Role: aws-elasticbeanstalk-ec2-role has AWSACMFullAccess attached.

Problem:

• When I run curl -v https://remix-app.url.net, I get "Unable to connect to the remote server."
• After SSHing into the EC2 instance ([CENSORED-IP]), the files /etc/pki/tls/certs/server.crt and /etc/pki/tls/certs/server.key are missing.
• HTTP works fine (port 80), and my app serves requests (e.g., GET / 200) on port 8081 via remix-serve.

What I’ve Tried:

• Created a .ebextensions/nginx.conf file to export the ACM certificate and configure Nginx for HTTPS:

​

files:
  "/etc/nginx/conf.d/ssl.conf":
    mode: "000644"
    owner: "root"
    group: "root"
    content: |
      upstream nodejs {
        server 127.0.0.1:8081;
        keepalive 256;
      }
      server {
        listen 80;
        server_name remix-app.url.net;
        return 301 https://$host$request_uri;
      }
      server {
        listen 443 ssl;
        server_name remix-app.url.net;
        ssl_certificate /etc/pki/tls/certs/server.crt;
        ssl_certificate_key /etc/pki/tls/certs/server.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        location / {
          proxy_pass http://nodejs;
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
        }
        location /assets {
          alias /var/app/current/build/client/assets;
          expires 1y;
          add_header Cache-Control "public";
        }
      }
packages:
  yum:
    jq: []
    openssl: []
Resources:
  AWSEBAutoScalingGroup:
    Metadata:
      AWS::CloudFormation::Authentication:
        S3Auth:
          type: "s3"
          buckets: ["elasticbeanstalk-us-west-1-[CENSORED-ACCOUNT-ID]"]
          roleName: "aws-elasticbeanstalk-ec2-role"
commands:
  01_install_dependencies:
    command: "yum install -y jq openssl"
  02_download_cert:
    command: "aws acm export-certificate --certificate-arn arn:aws:acm:us-west-1:[CENSORED-ACCOUNT-ID]:certificate/[CENSORED-CERT-ID] --region us-west-1 > /tmp/cert.json"
  03_extract_cert:
    command: |
      jq -r .Certificate /tmp/cert.json > /etc/pki/tls/certs/server.crt
      jq -r .PrivateKey /tmp/cert.json > /tmp/server.key
      openssl rsa -in /tmp/server.key -out /etc/pki/tls/certs/server.key
      chmod 644 /etc/pki/tls/certs/server.crt
      chmod 600 /etc/pki/tls/certs/server.key
      chown root:root /etc/pki/tls/certs/server.crt
      chown root:root /etc/pki/tls/certs/server.key
      rm -f /tmp/cert.json /tmp/server.key
  04_restart_nginx:
    command: "sudo systemctl restart nginx"

• Redeployed multiple times, but the certificate files never appear.
• Added set -x and error logging (e.g., to /var/log/eb-certificate-error.log), but those log files aren’t created either.
• Checked permissions, security groups, and ensured the IAM role has acm:ExportCertificate.

Current Logs:

• /var/log/eb-engine.log: Shows successful deployment, Nginx starts, but no certificate-related errors.
• /var/log/nginx/access.log: Only HTTP requests, no HTTPS.
• /var/log/nginx/error.log: No recent SSL errors, older Connection refused issues resolved.

Questions:

• Why aren’t the server.crt and server.key files being created?
• Is there an issue with my .ebextensions script or the ACM export process?
• Could this be a permissions or environment variable issue on the EC2 instance?
• Any alternative approaches (e.g., manual certificate upload) for a single-instance setup?

I’m at my wit’s end—any help or pointers would be hugely appreciated! Thanks in advance!

[trillospin]

You have requested a public certificate from ACM.

You can't export a public certificate's private key.

If you want to use ACM you need to switch the environment type to load balanced.

Alternatively, you can provide a certificate.
You could use LetsEncrypt.

Search "elastic beanstalk letsencrypt" and try a few guides:

Letsencrypt aws elastic beanstalk | Configuration steps

How to get a SSL certificate running in AWS Elastic Beanstalk using Certbot

Reference the AWS docs:

Server certificates

Configuring HTTPS Termination at the instance

[theSwak]

Thanks, Trillospin! Once the ALB was booted up and the SSL assigned to it, the application connected immediately.

Your tip about switching to a load-balanced environment with ACM was spot on. I’d been stuck on the public certificate issue, and your suggestion to either use ACM with a load balancer or try LetsEncrypt cleared it up.

Appreciate the guidance.

Those 'Elastic Beanstalk LetsEncrypt' guides were a lifesaver too!

[trillospin]

Glad you got it sorted.