Blog

Setting up an AWS EC2 Load Balancer for SSL termination is pretty straight forward once you have all required information at hand.

In this example we will be setting up a classic AWS EC2 Load Balancer for SSL termination.

Before we start configuring the load balancer make sure you have the following required assets at hand:

Server SSL private key
Server SSL certificate
Server SSL certificate chain (if required by your SSL setup)
AWS CLI working
1. Access to IAM via CLI
2. AWS Access Key ID
3. AWS Secret Access Key
Access to the AWS Management Console to setup classic EC2 Load Balancer
Optional: a cup of coffee or tea 😉

We will now go through all the steps required to get your EC2 Load Balancer for SSL termination up and running in no time.

Converting SSL certificates to PEM format

First and foremost, your Server SSL private key and your Server SSL certificate are required to be in PEM format.

If this is not the case use the following commands to convert your private key and certificate to PEM format:

Convert SSL private key to PEM format

openssl rsa -in server-key.key -text > server-key.pem

Convert SSL certificate to PEM format

openssl x509 -inform PEM -in server-certificate.crt > server-certificate.pem

Setup AWS CLI

In order to set up AWS CLI you may use the bundle provided by Amazon or install the requirements manually.

After the installation you will need to setup your AWS CLI credentials.

Make sure that the Policy IAMFullAccess is set for the target AWS CLI user:

Then, setup AWS CLI credentials using the following command:

aws configure

You will be prompted to enter your

AWS Access Key ID
AWS Secret Access Key

Once this is completed you can continue by installing your SSL certificate in AWS using AWS CLI and AWS IAM.

Installing SSL certificates in AWS IAM

Once you have AWS CLI working with your credentials it’s time to upload your SSL certificate together with the private key and optionally the certificate chain to AWS IAM:

Upload SSL certificate to AWS IAM

aws iam upload-server-certificate \
--server-certificate-name your-certificate-name \
--certificate-body file://server-certificate.pem \
--private-key file://server-key.pem

AWS CLI should respond with an appropriate success message, like so:

{
    "ServerCertificateMetadata": {
        "ServerCertificateId": "SOMEHASHVALUE", 
        "ServerCertificateName": "your-certificate-name", 
        "Expiration": "2018-09-14T23:59:59Z", 
        "Path": "/", 
        "Arn": "arn:aws:iam::SOME_NUMBER:server-certificate/your-certificate-name", 
        "UploadDate": "2017-09-15T09:40:52.183Z"
    }
}