CODEWITHSUNDEEP
amazon-web-servicesdnsamazon-snsamazon-route53
micah
micah

Reputation: 8096

CNAME to AWS Service - Browser Not Accepting Certificate

I am trying to access an AWS service directly from the browser- specifically the SNS service. I want to be able to post a message directly to an sns topic, but using a CNAME record so I can control which region the browser ultimately goes to (sns.mydomain.com -> sns.us-east-1.amazonaws.com | sns.eu-west-1.amazonaws.com depending on requesters region).

My issue is that if I make an HTTPS request to my aliased endpoint, the returned certificate will not be signed to my endpoint and the browser will refuse to work with it. And while I can get around this by making only HTTP requests, the browser will refuse to make an HTTP request from a secure origin (a site served on HTTPS).

Is it possible to have a CNAME point to an AWS service in the way that I'm trying to do it?

Ultimately, i'm trying to avoid locking the client application in the browser into an aws region.

Upvotes: 0

Views: 90

Answers (1)

erik258
erik258

Reputation: 16305

Is it possible to have a CNAME point to an AWS service in the way that I'm trying to do it?

No. You're hitting up against a central feature of https verification, namely the Common Name of the cert or a SAN ( Subject Alternative Name) must match the certificate. If it weren't so, HTTPS would not be validating that the server is who they claim to be.

Ultimately, i'm trying to avoid locking the client application in the browser into an aws region.

That's a fine goal. Instead of doing so at the DNS layer, why not create an endpoint or configuration setting that supplies region or regions to use? A smart client could even iterate through regions in the case of some failures that appeared to be regional outages, which is somewhat better than a CNAME that you still have to fix when a region goes down.

Upvotes: 2

Related Questions