HTTPS: Make the Application Speak HTTPS

Objective#

• Migrate our endpoint from HTTP to HTTPS.

Steps#

• Make the application speak HTTPS.
• Remove the HTTP endpoint.

Making our application speak HTTPS#

Let’s update our application to listen to HTTPS requests on port 8443. We’re going to make the application use the self-signed certificate that the EC2 instance generated in the UserData script when it came online.

Line #3: Import the https node library.

Line #8: We’ll use 8443 as our local HTTPS port number.

Line #9 and #10: Path to the key and certificate generated in the instance launch script.

Line #12: For a graceful roll-out, we’ll check for the key and certificate before launching the HTTPS server.

Line #16: We launch an HTTPS server if we have a key and certificate.

Line #28: We continue to launch our HTTP server until all traffic has been migrated.

And let’s push this change to GitHub.

Note: All the code has been already added and we are pushing it on our repository as well.

Now let’s wait for the deployment to go through. Our HTTP and HTTPS endpoints should then start working.

Removing the HTTP endpoint#

If this were a production migration, we would first wait for our users to migrate from the HTTP endpoint to HTTPS. Once that happens, we would tear down the HTTP infrastructure.

Let’s start by removing all the resources and outputs for the HTTP traffic and endpoints. We have to remove the endpoints before we modify the application code. To do otherwise would lead to failed health checks.

Let’s remove the following from stage.yml:

• from Resources

  • from SecurityGroup

    • from SecurityGroupIngress
      • the section for traffic on port 8080
      • the section for traffic on port 80

  • from ScalingGroup

    • the TargetGroupARNs entry for LoadBalancerTargetGroup

  • the entire LoadBalancerListener resource

  • the entire LoadBalancerTargetGroup resource

• from Outputs
  • the LBEndpoint output

And let’s remove the following from main.yml:

• from Outputs
  • the StagingLBEndpoint output
  • the ProdLBEndpoint output

We can now deploy the updates.

Now, our HTTP endpoints don’t exist anymore, and hitting them will result in a time out.

Let’s commit our infrastructure changes.

Note: All the code has been already added and we are pushing it on our repository as well.

And now, all that remains is to update our application to stop listening for HTTP requests.

Let’s push our application change to GitHub and wait for it to go through the pipeline.

We’ve successfully migrated our application from HTTP only to HTTPS only. We did this without affecting users, by being thoughtful about the phases of our migration.

In order to get a pictorial view of our developed cloudformation stack so far, below is the design view which shows the resources we created and their relationships.

In the next lesson, we will improve the network security of our stack, and make our instances inaccessible from the internet.