AWS Load Balencer is Configured for HTTPS, but App receives HTTP Requests

carpiediem 2017-08-10 05:36:56 UTC #1

IMPORTANT, please fill the questions

We assume you are using Bitnami to deploy your application.

Which version of the application are you using?:
Moodle powered by Bitnami v. 3.3.0-0 on Ubuntu 14.04
Please choose how you got the application: Installer (Windows, Linux, macOS), cloud image (AWS, GCE, Azure, ...) or VM (VMDK, VBOX):
Launched from AWS Marketplace
Have you installed any plugin or modified any configuration file?:
I made an edit to the config file to try and fix this issue, then reverted the file when it didn't help.
Describe here your question/suggestion/issue (expected and actual results):
I configured the Moodle EC2 instance to be accessed through a load balancer.
Steps to reproduce the issue (if relevant):
When I browse to the EC2 instance directly, using an HTTP connection, everything works well. I recently added the instance to target group.

Name: target-group-emotics-lms
ARN: arn:aws:elasticloadbalancing:ap-southeast-1:761966246213:targetgroup/target-group-emotics-lms/c9a852cee7ddc3cf
Protocol: HTTP
Port: 80

and used that target group in a load balancer with two listeners, HTTP & HTTPS. The load balancer was added to Route53 as an alias record.

lms.emotics.co.   A   ALIAS dualstack.lb-emotics-lms-716430027.ap-southeast-1.elb.amazonaws.com. (z1lms91p8cmle5)

Error Messages :
This succeeds in connecting to the server, but it seems to be turning my HTTPS requests into an HTTP request by the time it hits the Moodle app. The page inspector reveals many errors like this.

Mixed Content: The page at 'https://lms.emotics.co/' was loaded over HTTPS, but requested an insecure stylesheet 'http://lms.emotics.co/theme/yui_combo.php?rollup/3.17.2/yui-moodlesimple-min.css'. This request has been blocked; the content must be served over HTTPS.

Any ideas?

dbarranco 2017-08-10 14:15:03 UTC #2

Did you force the redirection to https? Could you please activate it?

We have some useful docs here explaining how to activate that feature.

Best regards.

carpiediem 2017-08-10 16:07:11 UTC #3

I had tried that, but I reverted the file when I got the error below. The httpd-prefix.conf file is as you suggest, now.

This page isn’t working
lms.emotics.co redirected you too many times.
Try clearing your cookies.
ERR_TOO_MANY_REDIRECTS

Does that suggest a second change I need to make?

jariza 2017-08-14 11:04:32 UTC #4

Hello @carpiediem

It seems that I can access your server using the URL: http://ec2-52-221-246-211.ap-southeast-1.compute.amazonaws.com

However, the ERR_TOO_MANY_REDIRECTS error appears when using http://lms.emtocis.co
or http://dualstack.lb-emotics-lms-716430027.ap-southeast-1.elb.amazonaws.com

The problem is that the Load Balancer is performing one redirection and the Apache Web Server included in your Cloud Image is performing its own redirections and there's a conflict between them.

Could you please share with us the content of the following configuration files in your server?

/opt/bitnami/apps/moodle/conf/httpd-app.conf
/opt/bitnami/apps/moodle/conf/httpd-vhosts.conf
/opt/bitnami/apps/moodle/conf/httpd-prefix.conf
/opt/bitnami/apps/moodle/conf/htaccess.conf

Best Regards,

Juan Ariza

carpiediem 2017-08-22 11:45:19 UTC #5

Thanks for your help, Juan; and sorry it took me a while to reply. As you might guess, I haven't worked with this configuration before.

There is no htaccess.conf file, as far as I can tell. Here are the rest.

httpd-app.conf

<IfDefine USE_PHP_FPM>
    <Proxy "unix:/opt/bitnami/php/var/run/moodle.sock|fcgi://moodle-fpm" timeout=300>
    </Proxy>
</IfDefine>

<Directory "/opt/bitnami/apps/moodle/htdocs">
    Options +Indexes +MultiViews
    AllowOverride None
    <IfVersion < 2.3 >
        Order allow,deny
        Allow from all
    </IfVersion>
    <IfVersion >= 2.3>
        Require all granted
    </IfVersion>
    
    
    <IfModule php5_module>
            php_value max_execution_time 300
    </IfModule>

    <IfDefine USE_PHP_FPM>
<IfModule pagespeed_module>
ModPagespeed off
</IfModule>

       <FilesMatch \.php$>
         SetHandler "proxy:fcgi://moodle-fpm"
       </FilesMatch>
    </IfDefine>

    Include "/opt/bitnami/apps/moodle/conf/banner.conf"
</Directory>

httpd-vhosts.conf

<VirtualHost *:80>
    ServerName moodle.example.com
    ServerAlias www.moodle.example.com
    DocumentRoot "/opt/bitnami/apps/moodle/htdocs"
    
    Include "/opt/bitnami/apps/moodle/conf/httpd-app.conf"
</VirtualHost>

<VirtualHost *:443>
    ServerName moodle.example.com
    ServerAlias www.moodle.example.com
    DocumentRoot "/opt/bitnami/apps/moodle/htdocs"
    SSLEngine on
    SSLCertificateFile "/opt/bitnami/apps/moodle/conf/certs/server.crt"
    SSLCertificateKeyFile "/opt/bitnami/apps/moodle/conf/certs/server.key"
    
    Include "/opt/bitnami/apps/moodle/conf/httpd-app.conf"
</VirtualHost>

httpd-prefix.conf

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R,L]

# App url moved to root
DocumentRoot "/opt/bitnami/apps/moodle/htdocs"
    #Alias /moodle/ "/opt/bitnami/apps/moodle/htdocs/"
#Alias /moodle "/opt/bitnami/apps/moodle/htdocs"

Include "/opt/bitnami/apps/moodle/conf/httpd-app.conf"

abjimenez 2017-08-23 11:36:13 UTC #6

Hi @carpiediem,

Thanks for sharing these files with us.

In the configuration of the load balancer, by default, HTTPS requests are redirected to HTTP so that's may be the reason of the ERR_TOO_MANY_REDIRECTS error. You already mentioned that in your first message:

You can read more about this here: AWS: Create an HTTPS Load Balancer.

Could you please try to force the redirections of the load balancer from HTTPS -> HTTP to HTTPS -> HTTPS?

Best regards,
Andrés Bono

carpiediem 2017-08-25 05:43:42 UTC #7

Thanks Andrés. I changed the load balancer's listener and everything is working. Strange, since I feel like I had done the same two weeks ago. Glad to have a solution, in any case.

abjimenez 2017-08-25 14:15:57 UTC #8

Hi @carpiediem,

That's great! We are glad to hear that.

Best regards,
Andrés Bono

mhaager 2018-03-30 20:11:54 UTC #9

I used this article to create the load balancer:

https://docs.bitnami.com/aws/how-to/configure-elb-ssl-aws/

Then these instructions from AWS to configure httpd-prefix.conf :

https://aws.amazon.com/premiumsupport/knowledge-center/redirect-http-https-elb/
Adding this to the top of httpd-prefix.conf:

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule .* https://%{HTTP:Host}%{REQUEST_URI} [L,R=permanent]

Previous entries resulted in infinite redirect. This worked for me.

crhernandez 2018-04-02 07:51:55 UTC #10

Hi,

Thank you for sharing this information, it sure is useful for other users.

Best regards,
Carlos R. Hernández

josh.davidson 2018-05-24 06:14:25 UTC #11

I have followed the @mhaager solution posted above and have everything working correctly with redirects, but now I am getting mixed content warnings. WP files are still being served over HTTP. I tried hard coding my domain with https (WP_SITEURL and WP_HOME) in wp-config.php but it didn't help. Any solutions for this out there?

josh.davidson 2018-05-24 15:40:40 UTC #12

Finally got it working! My site is redirecting all HTTP traffic to HTTPS with no mixed content security warnings. Thought I would post here as it took me forever to figure out.

I followed the @mhaager post above and then edited my /opt/bitnami/apps/wordpress/htdocs/wp-config.php file. I modifed the following lines to set the WP_SITEURL and WP_HOME to https:

define('WP_SITEURL', 'https://' . $_SERVER['HTTP_HOST'] . '/');
define('WP_HOME', 'https://' . $_SERVER['HTTP_HOST'] . '/');

and right above these lines a added the following:

if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)
    $_SERVER['HTTPS']='on';

Basically wordpress was seeing traffic come through on port 80 (http) and returning resources back on the same port which gave the mixed content errors. The above lines watch for a https forwarded header from the AWS ELB and then turns https replies on for WordPress.

Wordpress instance behind AWS Application Load Balancer and trouble with implementing HTTPS

AWS certificate, force direct to https://www

jota 2018-05-25 07:21:09 UTC #13

Hi @josh.davidson,

I'm really happy to hear that you managed to solve the issue. Your information also helped another guy in this forum

We will work on adding that information to our documentation

Enjoy!

Powered by Discourse, best viewed with JavaScript enabled

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!

SugarCRM

Drupal

WordPress

Joomla!

Redmine