Add a load balancer with Elastic Load Balancing for AWS CloudHSM(optional)

Open the Subnets section of the Amazon VPC console.

Choose Create Subnet.

In the Create Subnet dialog box, do the following:

1. For Name tag, type a name for your subnet.

2. For VPC, choose the AWS CloudHSM VPC that contains your existing web server and AWS CloudHSM cluster.

3. For Availability Zone, choose an Availability Zone that is different from the one that contains your existing web server.

4. For IPv4 CIDR block, type the CIDR block to use for the subnet. For example, type 10.0.10.0/24.

5. Choose Yes, Create.

Select the check box next to the public subnet that contains your existing web server. This is different from the public subnet that you created in the previous step.

In the content pane, choose the Route Table tab. Then choose the link for the route table.

Select the check box next to the route table.

Choose the Subnet Associations tab. Then choose Edit.

Select the check box next to the public subnet that you created earlier in this procedure. Then choose Save.

Open the Instances section of the Amazon EC2 console at.

Select the check box next to your existing web server instance.

Choose Actions, Image, and then Create Image.

In the Create Image dialog box, do the following:

1. For Image name, type a name for the image.

2. For Image description, type a description for the image.

3. Choose Create Image. This action reboots your existing web server.

4. Choose the View pending image ami-<AMI ID> link.

   

   In the Status column, note your image status. When your image status is available (this might take several minutes), go to the next step.

In the navigation pane, choose Instances.

Select the check box next to your existing web server.

Choose Actions and choose Launch More Like This.

Choose Edit AMI.

In the left navigation pane, choose My AMIs. Then clear the text in the search box.

Next to your web server image, choose Select.

Choose Yes, I want to continue with this AMI (<image name> - ami-<AMI ID>).

Choose Next.

Select an instance type, and then choose Next: Configure Instance Details.

For Step 3: Configure Instance Details, do the following:

1. For Network, choose the VPC that contains your existing web server.

2. For Subnet, choose the public subnet that you created for the second web server.

3. For Auto-assign Public IP, chooseEnable.

4. Change the remaining instance details as preferred. Then choose Next: Add Storage.

Change the storage settings as preferred. Then choose Next: Add Tags.

Add or edit tags as preferred. Then choose Next: Configure Security Group.

For Step 6: Configure Security Group, do the following:

1. For Assign a security group, choose Select an existing security group.

2. Select the check box next to the security group named cloudhsm-<cluster ID>-sg. AWS CloudHSM created this security group on your behalf when you created the cluster. You must choose this security group to allow the web server instance to connect to the HSMs in the cluster.

3. Select the check box next to the security group that allows inbound HTTPS traffic. You created this security group previously.

4. (Optional) Select the check box next to a security group that allows inbound SSH (for Linux) or RDP (for Windows) traffic from your network. That is, the security group must allow inbound TCP traffic on port 22 (for SSH on Linux) or port 3389 (for RDP on Windows). Otherwise, you cannot connect to your client instance. If you don't have a security group like this, you must create one and then assign it to your client instance later.

Choose Review and Launch.

Review your instance details, and then choose Launch.

Choose whether to launch your instance with an existing key pair, create a new key pair, or launch your instance without a key pair.

Choose Launch Instances.

Open the Load balancers section of the Amazon EC2 console.

Choose Create Load Balancer.

In the Network Load Balancer section, choose Create.

For Step 1: Configure Load Balancer, do the following:

1. For Name, type a name for the load balancer that you are creating.

2. In the Listeners section, for Load Balancer Port, change the value to 443.

3. In the Availability Zones section, for VPC, choose the VPC that contains your web servers.

4. In the Availability Zones section, choose the subnets that contain your web servers.

5. Choose Next: Configure Routing.

For Step 2: Configure Routing, do the following:

1. For Name, type a name for the target group that you are creating.

2. For Port, change the value to 443.

3. Choose Next: Register Targets.

For Step 3: Register Targets, do the following:

1. In the Instances section, select the check boxes next to your web server instances. Then choose Add to registered.

2. Choose Next: Review.

Review your load balancer details, then choose Create.

When the load balancer has been successfully created, choose Close.

In the Amazon EC2 console, find the DNS name for the load balancer that you just created. Then select the DNS name and copy it.

Use a web browser such as Mozilla Firefox or Google Chrome to connect to your load balancer using the load balancer's DNS name. Ensure that the URL in the address bar begins with https://.

Use your web browser to view the web server certificate. For more information, see the following:

Other web browsers might have similar features that you can use to view the web server certificate.

Ensure that the certificate is the one that you configured the web server to use.

Use the following OpenSSL command to connect to your load balancer using HTTPS. Replace <DNS name> with the DNS name of your load balancer.

openssl s_client -connect <DNS name>:443

Ensure that the certificate is the one that you configured the web server to use.