Using SSL

To use SSL with your application, you must first obtain a digital server certificate from a Certificate Authority (CA). For simplicity, this walkthrough creates a certificate and then self-signs it. Self-signed certificates are useful for learning and testing purposes, but you should always use a certificate signed by a CA for production stacks.

In this walkthrough, you'll do the following:

Step 1: Install and Configure OpenSSL

Creating and uploading server certificates requires a tool that supports the SSL and TLS protocols. OpenSSL is an open-source tool that provides the basic cryptographic functions necessary to create an RSA token and sign it with your private key.

The following procedure assumes that your computer does not already have OpenSSL installed.

Create an environment variable that points to the OpenSSL install point by opening a terminal or command window and using the following command lines.

Add the OpenSSL binaries' path to your computer's path variable by opening a terminal or command window and using the following command lines.

Step 2: Create a Private Key

You need a unique private key to create your Certificate Signing Request (CSR). Create the key by using the following command line:

openssl genrsa 2048 > privatekey.pem

Step 3: Create a Certificate Signing Request

A Certificate Signing Request (CSR) is a file sent to a Certificate Authority (CA) to apply for a digital server certificate. Create the CSR by using the following command line.

openssl req -new -key privatekey.pem -out csr.pem

The command's output will look similar to the following:

You are about to be asked to enter information that will be incorporated 
	into your certificate request.
	What you are about to enter is what is called a Distinguished Name or a DN.
	There are quite a few fields but you can leave some blank
	For some fields there will be a default value,
	If you enter '.', the field will be left blank.

The following table can help you create your certificate request.

Step 4: Submit the CSR to Certificate Authority

For production use, you would obtain a server certificate by submitting your CSR to a Certificate Authority (CA), which might require other credentials or proofs of identity. If your application is successful, the CA returns digitally signed identity certificate and possibly a certificate chain file. AWS does not recommend a specific CA. For a partial listing of available CAs, see Certificate Authority - Providers on Wikipedia.

You can also generate a self-signed certificate, which can be used for testing purposes only. For this example, use the following command line to generate a self-signed certificate.

openssl x509 -req -days 365 -in csr.pem -signkey privatekey.pem -out server.crt

The output will look similar to the following:

Loading 'screen' into random state - done
Signature ok
subject=/C=us/ST=washington/L=seattle/O=corporationx/OU=marketing/CN=example.com/emailAddress=someone@example.com
Getting Private key

Step 5: Edit the App

After you generate your certificate and sign it, update your app to enable SSL and provide your certificate information. On the Apps page, choose an app to open the details page, and then click Edit App. To enable SSL support, set Enable SSL to Yes, which displays the following configuration options.

After you click Save, redeploy the application to update your online instances.

For the built-in application server layers, AWS OpsWorks Stacks automatically updates the server configuration. After deployment is finished, you can verify that your OpenSSL installation worked, as follows.

Users who have configured apps to run in Mozilla Firefox sometimes get the following certificate error: SEC_ERROR_UNKNOWN_ISSUER. This error can be caused by certificate-replacement functionality in your organization's antivirus and antimalware programs, by some types of network traffic monitoring and filtering software, or by malware. For more information about how to troubleshoot this error, see How to troubleshoot security error codes on secure websites on the Mozilla Firefox Support website.

For all other layers, including custom layers, AWS OpsWorks Stacks simply adds the SSL settings to the app's deploy attributes. You must implement a custom recipe to retrieve the information from the node object and configure the server appropriately.