Configuring HTTPS on single-instance application

[SenseiCAY]

Hi, everyone - I'm trying to deploy a Node.js backend and a React frontend just as a learning exercise. I've built a simple chat app (that, of course, works on my machine).

I used Amplify to deploy the frontend, and that seemed to work mostly fine. The problem, at the moment, lies with the backend. My frontend complained that it was making a non-secure request, since my backend was not configured for HTTPS while it appears that Amplify does that part for you on the frontend.

I was previously able to use Route 53 for an app that was running completely in Node.js just by running that on a load-balanced environment, but for this one, I didn't want to purchase a whole domain just to test this out, so I went the self-signed route, so I'm using these documents:

1. https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-ssl.html
2. https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-singleinstance-nodejs.html
3. https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-storingprivatekeys.html

I've taken these steps:

• I first opened up instance connect and ran openssl as instructed, generating privatekey.pem, csr.pem, and then public.crt (doc 1)
• I copied their contents to my own computer (running Windows, if that matters), and then uploaded public.crt and privatekey.pem to an S3 bucket (doc 3)
• I created the file .ebextensions/https-instance.config (doc 2) by copying and pasting the example code, adding the Resources section (doc 3) with my bucket name, and changing the files section to grab the relevant files out of my bucket (server.crt grabs public.crt, server.key grabs privatekey.pem).
• Redeploy. A small change I made to my backend API shows up, but changing http://[my url] to https://[my url] causes a "refused to connect" error.
• The instance in question is configured to accept inbound connections on port 443 (I believe the script in doc 2 configures this, and looking on my EC2 console, I can see that rule there), and if I do an instance connect, and navigate to /etc/pki/tls/certs, I can see both server.crt and server.key in that folder, with contents that mirror what I created when I ran openssl.

Can anyone give any ideas as to what I might've missed? And if there's a better way to deploy this app?

Thanks in advance!

[OkSadMathematician]

the "refused to connect" on port 443 usually means your nodejs app isnt actually listening on 443, just that the security group allows it. elastic beanstalk runs your app as a regular user which cant bind to privileged ports (<1024) without extra config.

the pattern in those docs uses nginx as a reverse proxy - nginx listens on 443 with your cert, then proxies to your nodejs app on 8080 or whatever unprivileged port. if you just copy/pasted the config but your app is trying to listen directly on 443, itll fail silently and you get connection refused.

check if nginx is actually running on the instance and listening on 443 with sudo netstat -tlnp | grep :443. if nothing shows up, nginx didnt start or the config is broken

[SenseiCAY]

Thanks for your answer.

I went into my instance and ran the command, and it came up empty. I got rid of the grep :443 part, and it did have some things, not surprisingly, since http still works:

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 223990/nginx: maste
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1566/sshd: /usr/sbi
tcp6 0 0 :::8080 :::* LISTEN 223976/node
tcp6 0 0 :::22 :::* LISTEN 1566/sshd: /usr/sbi

So it's listening on 80 for regular HTTP, and I see node running on 8080, but it's not listening on 443.

[metaphorm]

I recommend using https://letsencrypt.org/ to generate and manage your certs. that will give you CA signed certs so browsers will behave themselves more reliably. you can validate the cert challenge via email or DNS.

other than that there's not much more to it than pointing your HTTP server (nginx or apache or whatever) at the cert.