‫Okay, so first I'm going to open ACM,
‫also called certificates manager in the console.
‫And in here,
‫I can see that I can provision certificates
‫and these are public certificates,
‫or I can provision private certificates
‫and they're a bit more advanced
‫and they're not in scope for the exam.
‫So just remember that ACM can be used to manage public
‫and private, but in this case,
‫we're just going to deal with public certificates.
‫Okay, we'll get started.
‫Here, we can either import a certificate
‫if you already had one from before,
‫and we just want it to be managed by ACM,
‫or we can even request a public certificate directly
‫from Amazon.
‫So let's do this.
‫We'll request a certificates and the domain name
‫is going to be acm-demo.stephanetheteacher.com.
‫We could add as many domain names as we want,
‫but I'll just keep this one.
‫And I own stephanetheteacher.com.
‫It's in my Route 53.
‫So that's perfect.
‫I'll click on next.
‫And we'll choose DNS validation
‫to validate that we do own the domain name
‫because we already have Route 53.
‫So that'll be very easy.
‫I'll click on review and say yes,
‫confirm and request.
‫Okay, so now the validation is in progress.
‫And if I expand this,
‫it says you need to create a CNAME record
‫in your DNS configuration for this to work.
‫Very easy though, we can directly click
‫on create record in Route 53 for having AWS create
‫that DNS record for us.
‫So it says, okay, we're going to add this CNAME
‫with this name and this value.
‫And all these things looks very random
‫because this is how SSL verification works
‫and we'll say, okay create.
‫Great.
‫So now the DNS record was written to Route 53 hosted zone,
‫and it may take up to 30 minutes for the changes
‫to propagates and AWS to validate the domain.
‫So I'll click on next.
‫And right now we're pending validation.
‫So we'll just pause the video until this is fully completed.
‫Okay, so my certificate has now be issued.
‫And so what I'm going to do now is use it.
‫And for this, we'll go to Beanstalk and we'll try to create
‫an environment that leverages that certificate.
‫So I'm going to do action, create environment.
‫It's going to be a web server environment,
‫click on select and for the domain,
‫I'll just keep the auto-generated value.
‫And I will choose a Node.js and I will choose
‫a simple application, but I will configure more options.
‫And in there, I'm going to go the paid route,
‫so I'm going to choose high availability
‫so that a load balancer is provisioned for me.
‫And in the load balancer configuration,
‫I'm going to modify it.
‫I'll choose an application load balancer.
‫And here I will add listeners.
‫So, add a listener.
‫The port is going to be 443,
‫and the protocol is going to be HTTPS.
‫And this is how we're going to load a certificate.
‫So it says, okay, which SSL certificate
‫would you like to load?
‫I would like to load the one that was just provisioned,
‫acm-demo.stephanetheteacher.com.
‫Excellent.
‫And the SSL policy is how strong do you want
‫your SSL policy to be.
‫I will choose the strongest,
‫which is the very last one.
‫But if you want it to support older clients
‫like Internet Explorer 5 or whatever,
‫you would choose a lower SSL security policy.
‫So in this one,
‫I'll just choose the highest ELB security policy.
‫Click on add and we're good.
‫Now I can even disable HTTP if I want it to,
‫but I'll just keep it for now.
‫And in terms of the rules,
‫everything looks good.
‫Let's scroll down.
‫Yep, everything looks perfect.
‫So let's go.
‫So this is all my custom configuration
‫and I'll create my environment right now.
‫So this is going to create just a very simple
‫Beanstalk application with a load balancer.
‫But now the specificity is that the load balancer
‫should have an SSL certificate on it
‫and we should be able to access our environment from there.
‫So let's wait for Beanstalk to be provisioned
‫and then we'll see what happens.
‫Okay, so my Beanstalk application has been created.
‫As we can see, I can click on this
‫and we have the congratulations.
‫And here, the URL is definitely not what we want
‫and it's also not secure.
‫So what do we have to do?
‫If you remember this course correctly,
‫we will have to create a CNAME record first
‫to have the right domain point to this.
‫So let's go back to our services
‫and I'm gonna go to Route 53.
‫And in there, I'm going to go to my hosted zone,
‫my domain, click create record sets,
‫and this is going to be a CNAME.
‫I think I called my acm-demo for my SSL certificate.
‫So, acm-demo.stephanetheteacher.com.
‫And the value of it is going to be this, right here.
‫So we have created a CNAME record, and here we go.
‫So now that means that I should be able to access my website
‫using acm-demo.stephanetheteacher.com.
‫So let's have a look and see if that works.
‫acm-demo.stephanetheteacher.com.
‫Okay, here we go.
‫So, we have access now to our Beanstalk environments
‫using this URL.
‫But it's still not secure.
‫It's because right now I only have forced HTTP,
‫but if I do HTTPS slash, slash, boom, here we go.
‫It works.
‫And we have a little luck here saying the connection
‫is secure.
‫That's because the SSL certificate get generated
‫and it's valid.
‫And if I click here, it's a Chrome feature.
‫It says that it was issued by Amazon and it is fully working
‫so I can get the details and so on.
‫And it is valid until Saturday, July 25th, 2020.
‫And it will be automatically renewed by Amazon
‫in case we need to.
‫So this is really good.
‫That means that ACM did provision our SSL certificates.
‫And finally, we can just verify that if we go to here,
‫so let's refresh this.
‫It says that now my certificate is in use.
‫And if we go here and see what it's in used by,
‫we need to go actually to the ELB service.
‫So we'll go to EC2 console and on our EC2 console,
‫I'll go to my load balancers,
‫find my Beanstalk balancer that was just created,
‫which is one of these two.
‫So let's have a look.
‫Is it this one?
‫Let's see the listeners.
‫No, it's not this one.
‫Is it this one?
‫Yes, it is.
‫So now we can see, we have two listeners.
‫We have port 80 and port 443.
‫And in this case, 443 is HTTPS.
‫So we have a security policy that we did apply.
‫And we did add the SSL certificates directly from ACM.
‫And we can click on view/edit certificates if we wanted to,
‫to just change the certificates.
‫So that's it.
‫Hopefully really helpful, but in the end,
‫we did manage our own application using Beanstalk and HTTPS,
‫which is a cool demo to do.
‫I hope you liked it and I will see you in the next lecture.