java ssl elastic_java-将SSL证书配置为单个Elastic Beanstalk TOMCA...

我试图在我的TOMCAT Elastic beantalk EC2实例中安装SSL证书.我还希望我的应用程序侦听端口443上的HTTPS请求.作为起点,我的解决方案基于this link.

经过一段时间的尝试,我无法安装我的证书或使端口443侦听HTTPS请求.

这些是我遵循的步骤：

1)我在src根目录下使用.ebextensions文件夹构建WAR,如下所示

ROOT.war

|

WEB-INF

META-INF

.ebextensions

|

https-instance-single.config

https-instance.config

2)https-instance.config文件内容

packages:

yum:

mod_ssl : []

container_commands:

1killhttpd:

command: "killall httpd"

ignoreErrors: true

2wait:

command: "sleep 3"

files:

# Apache HTTPS configuration

/etc/httpd/conf.d/ssl.conf:

mode: "000644"

owner: root

group: root

content: |

LoadModule ssl_module modules/mod_ssl.so

Listen 443

Order deny,allow

Allow from all

SSLEngine on

SSLCertificateFile "/etc/pki/tls/certs/server.crt"

SSLCertificateKeyFile "/etc/pki/tls/certs/server.key"

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

SSLProtocol All -SSLv2 -SSLv3

SSLHonorCipherOrder On

Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"

Header always set X-Frame-Options DENY

Header always set X-Content-Type-Options nosniff

ProxyPass / http://localhost:8080/ retry=0

ProxyPassReverse / http://localhost:8080/

ProxyPreserveHost on

# Public certificate

/etc/pki/tls/certs/server.crt:

mode: "000400"

owner: root

group: root

content: |

-----BEGIN CERTIFICATE-----

XXXXXXXXXXXXXXXXXXXXXXXXXXX

-----END CERTIFICATE-----

/etc/pki/tls/certs/server.key:

mode: "000400"

owner: root

group: root

content: |

-----BEGIN RSA PRIVATE KEY-----

XXXXXXXXXXXXXXXXXXXXXXXXXXX

-----END RSA PRIVATE KEY-----

/etc/pki/tls/certs/gd_bundle.crt:

mode: "000400"

owner: root

group: root

content: |

-----BEGIN CERTIFICATE-----

XXXXXXXXXXXXXXXXXXXXXXXXXXX

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

XXXXXXXXXXXXXXXXXXXXXXXXXXX

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

XXXXXXXXXXXXXXXXXXXXXXXXXXX

-----END CERTIFICATE-----

3)https-instance-single.config文件内容

Resources:

sslSecurityGroupIngress:

Type: AWS::EC2::SecurityGroupIngress

Properties:

GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}

IpProtocol: tcp

ToPort: 443

FromPort: 443

CidrIp: 0.0.0.0/0

4)然后,我使用弹性beantalk控制台部署了WAR(在此过程中,至少在控制台上未抛出任何错误消息).

在按规定部署My war之后,我的Web应用程序运行正常,但是没有SSL配置,并且HTTPS请求没有重定向到端口443.更糟糕的是,该应用程序甚至没有在侦听HTTPS请求.

有人有灯吗？我不想使用ELB(弹性负载平衡器),因为Im迁移了一堆小应用程序,这会给我带来可观的成本增加(每个应用程序约20美元).