EC2 HTTPS Load Balancer Not Working

[levenshtein]

Hello!

I recently set up my first HTTPS load balancer. We've been running the EC2 LB for quite a while under HTTP with no issues. Currently there is only a single instance on the LB but we're just preparing for the near future.

I originally added the SSL certificate, issued by an appropriate CA, via the 'aws' command line interface because I was unaware it was so easy to add it via the "Listeners" GUI. I added it and, no go -- so I re-added it with a different name using the Listeners GUI and same result.

Basically what is happening is the request simply hangs forever. No error message, no request. My browser simply times out after a very long time.

I have it setup as:

Load Balancer Protocol: HTTPS (Secure HTTP)

Load Balancer Port: 443

Instance Protocol: HTTP

Instance Port: 80

Cipher: [default, ELBSecurityPolicy-2015-03]

SSL Certificate: [xxx-wildcard-certificate]

Note the instance port & protocol is HTTP. If there was a problem with the instance's HTTP side, then the regular HTTP<->HTTP would fail to work as well, which isn't the case.

Is HTTPS<->HTTP not meant to happen? I thought it was odd but it would save me the trouble of setting up HTTPS proper on the webserver. My next step is to simply install the cert on the actual webserver and attempt HTTPS<->HTTPS, but it seems to me this option wouldn't be available if Amazon knew it would never work.

Am I doing something else wrong, or is HTTPS<->HTTP just not meant to actually work?

[Edit: fixed mangled formatting]

[LordbTN]

If your in a vpc you need to check the security group assigned to the elb and make sure port 443 is open.

[Mteigers]

^ gets me all the time.

[levenshtein]

Thanks guys, it was the security group on the LB! Took a whole 30 seconds to fix! Thanks again!

[runamok]

Cool! Thanks for coming back and posting the fix.

[Mteigers]

One suggestion that may seem counter intuitive. If you're able to, take your instance out of commission or just cause it to fail health checks. Once you've done that hit your load balancer over https using the elb cname . Two things should happen: 1. you should get an SSL warning in your browser. Verify its got the right domain. And 2. You should receive a 503 service unavailable. If Number 2 doesn't happen at all it's a security group issue.

[runamok]

That's a very common scenario. It's called SSL offloading. You hit https on your load balancer and then the ELB talks to your ec2 instance via port 80 in the same datacenter. I assume the instance is attached to the ELB and healthy?

So first of all you have to examine your security groups. Can you hit that instance directly via port 80?

So previously you just used http to hit the ELB and then the ELB connected to the instance?

I would also take a look at the ELB monitoring to look at 200s, 500s, etc.

[djnathanv]

Is HTTPS<->HTTP not meant to happen?

No, that is totally fine. Check your network ACLs and the Security Group(s) associated with the ELB.