英文:
Front, backend https with one ACM, frontend is okay, but backend also https and htttp
问题
一个 ACM 证书已经颁发给 *.example.com。使用这个证书，它被应用到名为 example.com 的公共 Route 53 作为 CNAME，并连接了两个负载均衡器。这两个负载均衡器分别运行前端和后端服务。
然而，问题在于前端应用了 https，但后端没有应用。
后端的域名，例如 api.example.com，可以同时通过 http 和 https 访问。
我在后端负载均衡器上将 HTTP 80 重定向到 HTTPS 443，但为什么没有生效？
即使通过 http 访问前端，它也会被重定向到 https。
记录 A 已经配置为 'api.example.com'，并且后端负载均衡器同样配置为将 http 80 重定向到 https 443。
然而，如果通过 http 访问，您会看到一个没有显示 SSL 认证的服务器，而如果通过 https 访问，您会看到一个显示 SSL 认证的服务器。
理应设置为 80 重定向到 443。
英文:
One ACM was issued to *.example.com. With this, it was applied to public route 53 called example.com as CNAME, and two load balancers were connected using it. The two load balancers ran front and back-end services, respectively.
However, the problem is that the frontend was applied with https, but the backend was not applied.
The domain of the backend is, for example, api.example.com, which was accessible to both http and https.
I redirected HTTP 80 to HTTPS 443 on the back-end load balancer, but why didn't it apply?
The front end is redirected to https even if it is accessed through http.
Record A was given 'api.example.com' and the backend load balancer is equally http 80 redirect https 443.
However, if you access through http, you can see a server that does not display ssl authentication, and if you access through https, you can see a server that shows ssl authentication.
Naturally, it was set to 80 redirect 443 forward.
答案1
得分: 0
请检查后端负载均衡器是否与SSL证书关联。
当将Route53与ACM SSL证书关联时，它仅验证域名的所有权。Route53是一个DNS服务，不参与SSL加密。这是您拓扑结构中负载均衡器的工作。
此外，您可以使用别名记录而不是CNAME记录来路由到部署在AWS上的负载均衡器；然后Route53的DNS调用是免费的。（我不确定您提到的CNAME记录是实际的路由记录还是验证记录，因此决定提及这一点。）
英文:
Check the backend load balancer if it has an SSL cert associated with it.
When you associate Route53 with an ACM SSL cert, it only validates the ownership of the domain. Route53 is a DNS service, it does not participate in SSL encryption. It is the load balancer's job in your topology.
Also, you can use an Alias record instead of CNAME to route to load balancers deployed on AWS; then the Route53 DNS calls are free. (I was not sure whether the CNAME record you mentioned was the actual routing record or just the validation one, so decided to mention that.)
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论