AWS ELB后端认证及端到端加密配置技术问询

Hey there, let’s tackle your AWS ELB questions one by one—this is a common setup folks struggle with when aiming for end-to-end encryption:

1. 什么是ELB中配置的实例公钥（.pem编码）？ #

This is the public key portion of the SSL certificate your EC2 instances use for encrypted connections. Think of it as a "trust anchor" for the ELB: when you upload this .pem file to the ELB's backend authentication settings, you're telling the load balancer to verify that the EC2 instance it's communicating with presents a certificate that matches (or is signed by) this public key.

Typically, this .pem file is either:

• The public certificate (often a .crt file, which is already pem-encoded) of your EC2 instance's SSL certificate, or
• The root CA certificate that issued your EC2 instance's SSL certificate (if you're using a trusted CA instead of self-signed certs).

For testing purposes, you can generate a self-signed certificate's .pem with OpenSSL:

openssl req -x509 -newkey rsa:4096 -keyout server.key -out server.crt -days 365 -nodes
# The .crt file is already pem-encoded, so you can rename it directly
cp server.crt server.pem

2. 443端口下，未配置后端认证时，ELB与EC2的流量是否加密？ #

No, it won’t be encrypted by default. Here’s the breakdown:

• The ELB’s 443 front-end port handles encrypted HTTPS traffic from users to the ELB—this part is encrypted if you’ve bound an SSL certificate to the front-end listener.
• But by default, the ELB will decrypt that traffic and send plain-text HTTP to your EC2 instance’s port 80 (or whatever unencrypted port you specify). Even if you use 443 on the front-end, the backend connection stays unencrypted unless you explicitly configure it.

3. 实现用户到ELB、ELB到EC2的端到端加密的详细步骤 #

Follow these steps to lock down the full traffic path:

Step 1: Set up SSL on your EC2 instances #

• Install your SSL certificate (self-signed or CA-issued) on your EC2’s web server (Nginx, Apache, etc.).
• Configure the web server to listen on an encrypted port (usually 443 or 8443) and use the certificate/key pair to encrypt traffic.
  • For Nginx, add a server block with listen 443 ssl; and point to ssl_certificate (your .pem/.crt) and ssl_certificate_key (your .key).

Step 2: Configure the ELB's front-end HTTPS listener #

• Go to your ELB’s console, navigate to Listeners.
• Add or edit a listener with:
  • Frontend: Port 443, Protocol HTTPS
  • Bind an SSL certificate (use AWS Certificate Manager (ACM) for a free trusted cert in production).

Step 3: Configure the ELB's backend encrypted listener #

• In the Listeners settings, for the backend target group:
  • Set Backend port to your EC2’s encrypted port (e.g., 443)
  • Set Backend protocol to HTTPS (not HTTP)

Step 4: Enable backend authentication (optional but recommended) #

• In your ELB’s target group settings, go to Backend authentication.
• Upload the .pem file (either your EC2’s public certificate or the CA root cert that issued it).
• This ensures the ELB only communicates with EC2 instances presenting a valid, trusted certificate—preventing man-in-the-middle attacks.

Step 5: Verify the setup #

• Use a browser to visit your ELB’s domain; check the SSL certificate details to confirm the user-to-ELB link is encrypted.
• On your EC2 instance, run a packet capture to confirm ELB-to-EC2 traffic is encrypted:

  sudo tcpdump port 443 -A | grep -i "http"
  # If traffic is encrypted, you’ll only see garbled text (no readable HTTP headers)
  

内容的提问来源于stack exchange，提问作者nirav