8 ms·
Does this mean that ALB/ELB supports SNI now? Or they only allow you to do this with subdomains under a wildcard cert?
by fullsage 9y ago
Does this mean that ALB/ELB supports SNI now? Or they only allow you to do this with subdomains under a wildcard cert?
- merb 9y agojust from reading the docs there is no indication about SNI.
- wichert 9y agoYou can only configure a single SSL listener per load balancer, and that listener can only use a single certificate. That means you do indeed still need to use either wildcard certs or certs with multiple hostnames. Luckily you can very easily create those through the AWS certificate manager for free.
- statictype 9y agoWait - AWS has a service to generate wild card Certs that can be attached to ELB? Did not realise this was a thing
- zwily 9y agoYes, and they automatically renew. It's fantastic. If you're using ELB/ALB, it's by far the easiest way to do SSL. The only downside is that initial setup of a certificate requires email confirmation, so if you need to provision a lot, LE may still win.
- zob_cloud 9y agoAnd they're free! Although only can be used on AWS services, currently ELB and CloudFront. https://aws.amazon.com/certificate-manager/ https://aws.amazon.com/certificate-manager/
- sudhirj 9y agoThink ALB already supported only SNI. Cloudfront has an offering that supports the older standard, but that's really expensive because of the need for all the static IPs. Think the load balancers never had the possibility of static IPs, so SNI from the start. But yeah, like another comment said, with the built in ACM managing certs is a non issue. It's like having an AWS specific Lets Encrypt for any service you want.
- zwily 9y agoALB definitely does not support SNI yet.