Enabling SSL on Rails 4 with AWS Load Balancer Ngnix and Puma

Question

I have tried unsuccessfully to configure SSL for my project.

My AWS load balancer is configured correctly and accepts the certificate keys. I have configured the listeners to route both port 80 traffic and port 443 traffic to my port 80 on the instance.

I would imagine that no further modification is necessary on the instance (Nginx and Puma) since everything is routed to port 80 on the instance. I have seen examples where the certificate is installed on the instances but I understand the load balancer is the SSL termination point so this is not necessary.

When accessing via http://www.example.com eveything works fine. However, accessing via https://www.example.com times out.

I would appreciate some help with the proper high-level setup.

Edit: I have not received any response to this question. I assume it is too general? I would appreciate confirmation that the high level reasoning I am using is the right one. I should install the certificate in the load balancer only and configure the load balancer to accept connections on the 443 port, BUT route everything on the 80 port internally to the web server instances.

Answer 1

Michael Fehr's answer worked and should be the accepted answer. I had the same problem, adding the config.force_ssl = true is what I missed. With the remark that you don't need to add the ebs configuration file they say you have to add if you are using the load balancer. That can be misleading and they do not specify it in the docs

Answer 2

I just stumbled over this question as I had the same problem: All requests to https://myapp.com timed-out and I could not figure out why. Here in short how I could achieve (forced) HTTPS in a Rails app on AWS:

My app:

Rails 5 with enabled config.force_ssl = true (production.rb) - so all connections coming from HTTP will get re-routed to HTTPS in the Rails App. No need to set-up difficult nginx rules. The same app used the gem 'rack-ssl-enforcer' as it was on Rails 4.2.

Side note: AWS LoadBalancers used in the past HTTP GET requests to check the health of the instances (today they support HTTPS). Therefore exception rules had to be defined for the SSL enforcement: Rails 5: config.ssl_options = { redirect: { exclude: -> request { request.path =~ /health-check/ } } } (in production.rb) with a respective route to a controller in the Rails App.

Side note to side note: In Rails 5, the initializer new_framework_defaults.rb has already defined "ssl_options". Make sure to deactivate this before using the "ssl_options" rule in production.rb.

AWS:

Elastic Beanstalk set-up on AWS with a valid cert on the Load Balancer using two Listener rules:

1. HTTP 80 requests on LB get directed to HTTP 80 on the instances

2. HTTPS 443 requests on LB get directed to HTTP 80 on the instances (here the certificate needs to be applied)

You see that the Load Balancer is the termination point of SSL. All requests coming from HTTP will go through the LB and will then be redirected by the Rails App to HTTPS automatically.

The thing no one tells you

With this in place, the HTTPS request will still time-out (here I spent days! to figure out why). In the end it was an extremely simple issue: The Security Group of the LoadBalancer (in AWS console -> EC2 -> Security Groups) only accepts requests on Port 80 (HTTP) -> Just activate Port 443 (HTTPS) as well. It should then work (at least it did for me).

Answer 3

I don't know if you managed your problem but for whoever may find this question here is what I did to get it working.

I've been all day reading and found a mix of two configurations that at this moment are working

Basically you need to configure nginx to redirect to https, but some of the recommended configurations do nothing to the nginx config.

Basically I'm using this gist configuration: https://gist.github.com/petelacey/e35c98f9a35063a89fa9

But from this configuration I added the command to restart the nginx server: https://gist.github.com/KeithP/f8534c04d20c2b4e4b1d

My take on this is that when the eb deploy process manages to copy the config files nginx has already started(?) making those changes useless. Hence the need to manually restarted, if some has a better approach let us know