{"id":438,"date":"2018-03-12T15:44:25","date_gmt":"2018-03-12T05:44:25","guid":{"rendered":"https:\/\/www.docx4java.org\/blog\/?p=438"},"modified":"2018-03-12T15:44:25","modified_gmt":"2018-03-12T05:44:25","slug":"using-https-on-fargate","status":"publish","type":"post","link":"https:\/\/www.docx4java.org\/blog\/2018\/03\/using-https-on-fargate\/","title":{"rendered":"Using HTTPS on FarGate"},"content":{"rendered":"

This is the second post in a series on scaling the PDF Converter using Amazon’s FarGate service.<\/p>\n

In the first post, we got the PDF Converter running across 2 instances behind a load balancer, in under 20 minutes.<\/p>\n

Now, we want to use HTTPS.\u00a0 The Amazon documentation is at\u00a0https:\/\/docs.aws.amazon.com\/elasticloadbalancing\/latest\/application\/create-https-listener.html<\/p>\n

First, go to the AWS Certificate Manager (ACM):\u00a0https:\/\/console.aws.amazon.com\/acm\/home?region=us-east-1#\/firstrun\/ to request a certificate (for your domain).<\/p>\n

Now go to your load balancer, and choose “create listener<\/strong>“. Choose HTTPS.\u00a0 You should see something like:<\/p>\n

\"alb-https-listener\"<\/a><\/p>\n

(here I’ve used plutext.com, but obviously you’ll have substituted your own domain).<\/p>\n

If\/when you click “create”, you’ll probably get a warning saying your security group doesn’t allow HTTPS, so click on the security group to allow traffic on port 443.<\/p>\n

We’re not quite there yet.\u00a0 If you try converting using your load balancer endpoint (something like\u00a0https:\/\/EC2Co-EcsEl-1GY7BNHSDU1HTH-1150934046.us-east-1.elb.amazonaws.com:443), you’ll get an error saying the certificate subject name does not match target host name.<\/p>\n

To overcome this, you need to update your DNS records so you have a host with the right name resolving to the load balancer.<\/p>\n

The\u00a0recommended\u00a0way to do this is to use Amazon’s Route53 DNS.<\/p>\n

But just to prove what we’ve done so far\u00a0works, its enough to put an entry in your \/etc\/hosts file mapping a host covered by your certificate, to the load balancer’s IP address.\u00a0 Then:<\/p>\n

$ curl -v -X POST --data-binary @HelloWorld.docx -o out.pdf https:\/\/fargate.plutext.com:443\/v1\/00
\n000000-0000-0000-0000-000000000000\/convert
\nNote: Unnecessary use of -X or --request, POST is already inferred.
\n% Total \u00a0\u00a0\u00a0% Received % Xferd \u00a0Average Speed \u00a0\u00a0Time \u00a0\u00a0\u00a0Time \u00a0\u00a0\u00a0\u00a0Time \u00a0Current
\nDload \u00a0Upload \u00a0\u00a0Total \u00a0\u00a0Spent \u00a0\u00a0\u00a0Left \u00a0Speed
\n0 \u00a0\u00a0\u00a0\u00a00 \u00a0\u00a0\u00a00 \u00a0\u00a0\u00a0\u00a00 \u00a0\u00a0\u00a00 \u00a0\u00a0\u00a0\u00a00 \u00a0\u00a0\u00a0\u00a0\u00a00 \u00a0\u00a0\u00a0\u00a0\u00a00 --:--:-- --:--:-- --:--:-- \u00a0\u00a0\u00a0\u00a00* \u00a0\u00a0Trying 54.89.45.53...
\n* Connected to fargate.plutext.com (54.89.45.53) port 443 (#0)
\n* found 148 certificates in \/etc\/ssl\/certs\/ca-certificates.crt
\n* found 597 certificates in \/etc\/ssl\/certs
\n* ALPN, offering http\/1.1
\n0 \u00a0\u00a0\u00a0\u00a00 \u00a0\u00a0\u00a00 \u00a0\u00a0\u00a0\u00a00 \u00a0\u00a0\u00a00 \u00a0\u00a0\u00a0\u00a00 \u00a0\u00a0\u00a0\u00a0\u00a00 \u00a0\u00a0\u00a0\u00a0\u00a00 --:--:-- --:--:-- --:--:-- \u00a0\u00a0\u00a0\u00a00* SSL connection using TLS1.2 \/ ECDHE_RSA_AES_128_GCM_SHA256
\n* \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0server certificate verification OK
\n* \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0server certificate status verification SKIPPED
\n* \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0common name: *.plutext.com (matched)
\n* \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0server certificate expiration date OK
\n* \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0server certificate activation date OK
\n* \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0certificate public key: RSA
\n* \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0certificate version: #3
\n* \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0subject: CN=*.plutext.com
\n* \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0start date: Mon, 12 Mar 2018 00:00:00 GMT
\n* \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0expire date: Fri, 12 Apr 2019 12:00:00 GMT
\n* \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0issuer: C=US,O=Amazon,OU=Server CA 1B,CN=Amazon
\n* \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0compression: NULL
\n* ALPN, server accepted to use http\/1.1
\n> POST \/v1\/00000000-0000-0000-0000-000000000000\/convert HTTP\/1.1
\n> Host: fargate.plutext.com
\n> User-Agent: curl\/7.47.0
\n> Accept: *\/*
\n> Content-Length: 4082
\n> Content-Type: application\/x-www-form-urlencoded
\n> Expect: 100-continue
\n>
\n< HTTP\/1.1 100 Continue
\n0 \u00a04082 \u00a0\u00a0\u00a00 \u00a0\u00a0\u00a0\u00a00 \u00a0\u00a0\u00a00 \u00a0\u00a0\u00a0\u00a00 \u00a0\u00a0\u00a0\u00a0\u00a00 \u00a0\u00a0\u00a0\u00a0\u00a00 --:--:-- \u00a00:00:01 --:--:-- \u00a0\u00a0\u00a0\u00a00} [4082 bytes data]
\n* We are completely uploaded and fine
\n< HTTP\/1.1 200 OK
\n< Date: Mon, 12 Mar 2018 05:01:52 GMT
\n< Content-Type: application\/pdf
\n< Content-Length: 38507
\n< Connection: keep-alive
\n< access-control-allow-origin: *
\n<
\n{ [16384 bytes data]
\n100 42589 \u00a0100 38507 \u00a0100 \u00a04082 \u00a016903 \u00a0\u00a01791 \u00a00:00:02 \u00a00:00:02 --:--:-- 16903
\n* Connection #0 to host fargate.plutext.com left intact<\/code><\/p>\n

Now we know it works, you can\u00a0add a CNAME record at your DNS provider, mapping your\u00a0chosen host name to the load balancer’s host name.<\/p>\n

Remove the entry we added to \/etc\/hosts, give your CNAME entry time to propogate, then\u00a0verify the curl command works.<\/p>\n","protected":false},"excerpt":{"rendered":"

This is the second post in a series on scaling the PDF Converter using Amazon’s FarGate service. In the first post, we got the PDF Converter running across 2 instances behind a load balancer, in under 20 minutes. Now, we want to use HTTPS.\u00a0 The Amazon documentation is at\u00a0https:\/\/docs.aws.amazon.com\/elasticloadbalancing\/latest\/application\/create-https-listener.html First, go to the AWS Certificate […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-438","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.docx4java.org\/blog\/wp-json\/wp\/v2\/posts\/438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.docx4java.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.docx4java.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.docx4java.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.docx4java.org\/blog\/wp-json\/wp\/v2\/comments?post=438"}],"version-history":[{"count":1,"href":"https:\/\/www.docx4java.org\/blog\/wp-json\/wp\/v2\/posts\/438\/revisions"}],"predecessor-version":[{"id":440,"href":"https:\/\/www.docx4java.org\/blog\/wp-json\/wp\/v2\/posts\/438\/revisions\/440"}],"wp:attachment":[{"href":"https:\/\/www.docx4java.org\/blog\/wp-json\/wp\/v2\/media?parent=438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.docx4java.org\/blog\/wp-json\/wp\/v2\/categories?post=438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.docx4java.org\/blog\/wp-json\/wp\/v2\/tags?post=438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}