1

I am using Amazon's EC2 to host my RDS database. I access the database via http calls to the EC2 instance, which in turn contacts the database. I would like to use https instead to allow for a more secure connection.

I am new to the world of security. From what I have read so far, I need to get a Certificate Authority to validate my domain. I pay a fee and they will validate for a certain time frame.

1) Can I use my Public DNS address to get the SSL certificate?

2) Are there any free CA's that are known as trusted that I can use to obtain a certificate?

3)I want to use https because the EC2 instance will be handling user login. Should I go ahead and use regular http and send information that way instead of trying to set up https?

Any and all advice/input welcome. Thanks in advance.

  • If you sit on both sides of a TLS connection you can use a self signed certificate. In some conditions this is even more secure than trusting any recognized CA. – eckes Dec 28 '17 at 6:10
5

1) Can I use my Public DNS address to get the SSL certificate?

No; to quote this Amazon tutorial,

If you plan to use your EC2 instance to host a public web site, you
need to register a domain name for your web server or transfer an
existing domain name to your Amazon EC2 host.

The "Public DNS address" from Amazon (which looks something like ec2-1-2-3-4.compute-1.amazonaws.com) won't work because you are not Amazon. You need to get your own domain so that you're authorized to get certs for it.

2) Are there any free CA's that are known as trusted that I can use to obtain a certificate?

StartSSL is the traditional answer for this, but they're under a cloud and probably don't fit what you call "trusted".

LetsEncrypt is another good answer that will probably fit your needs, especially where it's you needing access to your service (and not, say, a wide customer base of varied people and browsers).

3)I want to use https because the EC2 instance will be handling user login. Should I go ahead and use regular http and send information that way instead of trying to set up https?

No, there's a hundred good reasons to use HTTPS, and very few good reasons not to.

  • 1
    Re 2. It is worth noting that if you only need limited access to a cert protected resource, e.g. from one or two development machines. You only really need a self-signed cert. Many people refer to these as giving less security and this is not correct. They give less trust but the security can be even higher than commercial certs since you have full control over the creation process. But using SSCs means finding secure ways to deliver the new root certificate. That's easy for a few machines but gets hard for many. You also have to keep the private key of the root secure - always. – Julian Knight Jan 6 '17 at 9:31
  • Since I'm new to this I decided to go with LetsEncrypt as per the suggestions and because of how easy it is to set up. I used dot.tk to host and got the domain certified ! Thanks for everyone's help! – Lakshan Sivananthan Jan 6 '17 at 15:14
  • @gowenfawr Let’s encrypt doesn’t sign public ɪᴘ. – user2284570 Dec 28 '17 at 3:55
  • @user2284570 no one here is talking about getting a cert for the public IP address - the "public DNS address" mentioned is the Amazon domain-branded hostname for the public IP they gave you. (You're correct that LetsEncrypt won't issue certs for public IP addresses, but that's not relevant here.) – gowenfawr Dec 28 '17 at 21:17
0

Accessing your database over HTTP leaves it open to interception so it is hoped that there is no sensitive information in it nor any authentication (since you are passing your id and password in the clear over the Internet).

1) Can I use my Public DNS address to get the SSL certificate?

That is what you should do. UPDATE: Of course, that only works when using your own domain name - you can't do that if using an AWS domain name.

2) Are there any free CA's that are known as trusted that I can use to obtain a certificate?

There are some but they are limited. LetsEncrypt and StartSSL for example. The level of trust is limited though since they don't provide any background checks to prove that you are legitimate.

UPDATE: I may have been a bit negative seeming about LE. It is absolutely fine for low-trust use. A step up from a self-signed cert (though that is also fine if you can get through the issue of installing root certs to all clients). It depends on your use case though and how much trust you need to apply. Without knowing the details, I can't tell you what level of trust you need. LE certs might be fine or you might need to go to the opposite extreme of an extended validation cert.

Also note that LE certs have a very short lifespan. That means that realistically, you have to have an automated certificate renewal script in place and that does reduce the security slightly unless you do the renewal outside the server the cert is for.

3)I want to use https because the EC2 instance will be handling user login. Should I go ahead and use regular http and send information that way instead of trying to set up https?

NEVER do logins over HTTP! Again, it would mean sending sensitive data in clear text over the Internet. That just invites someone to intercept it and misuse the information.

  • Let's Encrypt provide the same level of trust as any other certificate authorities for domain validation certificates. They just don't issue EV (Extended validation) certificates. StartSSL may not be trusted by all browser, be careful. – Tom Jan 5 '17 at 23:02
  • No, the level of trust is certainly not the same. They don't do any checks on the validity of the claim or the claimant. The level of physical security is the same but that isn't the same as trust. Please don't confuse the two. If you present me with an HTTPS connection to your website and it has a LE cert, if I bother to check (which 99.99% of people wont of course), I will not be able to trust your site as I would if it had a Verisign cert where they do some verification checks even on standard certs. – Julian Knight Jan 6 '17 at 9:19
  • "standard certs" doesn't exists. There is DV (Domain Validation, the most common), OV (Organization Validation) and EV (Extended validation, aka "green bar"). A DV certificate from Let's encrypt has the same level of trust of a DV certificate from Verisign. A DV certificate only certify one thing: the person who control the certificate has control over the website. OV certificates add litte check over the owner, and EV adds more checks. – Tom Jan 6 '17 at 9:49
  • @Tom, thanks for providing the explanation. I realise that LE uses a form of DV. What I've not explained very well is that process matters when it comes to trust. The largely automated processes for LE - which allows them to deliver certs for free by keeping costs to a minimum - cannot provide the same level of trust as an organisation that does DV using people, entries required in DNS, etc. – Julian Knight Jan 6 '17 at 14:47
  • About trust the process matter, and that's why, about DV certificated, Let's Encrypt is to be more trusted: they have a clear documented process (see ACME) and an open source back-end (boulder). And they don't do validation by email as others may do (email validation is really weak) – Tom Jan 6 '17 at 15:05
-2

For free/trial SSL certificate, you should go with either Symantec, Comodo or RapidSSL. They are world's leading SSL Certificate Authorities and also accepted by 99.9% modern browsers.

  • They disallow static public ɪᴘs. – user2284570 Dec 28 '17 at 3:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.