Instructor: Okay, so first I'm going to open ACM,
also called certificates manager in the console.
And in here,
I can see that I can provision certificates
and these are public certificates,
or I can provision private certificates
and they're a bit more advanced
and they're not in scope for the exam.
So just remember that ACM can be used to manage public
and private, but in this case,
we're just going to deal with public certificates.
Okay, we'll get started.
Here, we can either import a certificate
if you already had one from before,
and we just want it to be managed by ACM,
or we can even request a public certificate directly
from Amazon.
So let's do this.
We'll request a certificates and the domain name
is going to be acm-demo.stephanetheteacher.com.
We could add as many domain names as we want,
but I'll just keep this one.
And I own stephanetheteacher.com.
It's in my Route 53.
So that's perfect.
I'll click on next.
And we'll choose DNS validation
to validate that we do own the domain name
because we already have Route 53.
So that'll be very easy.
I'll click on review and say yes,
confirm and request.
Okay, so now the validation is in progress.
And if I expand this,
it says you need to create a CNAME record
in your DNS configuration for this to work.
Very easy though, we can directly click
on create record in Route 53 for having AWS create
that DNS record for us.
So it says, okay, we're going to add this CNAME
with this name and this value.
And all these things looks very random
because this is how SSL verification works
and we'll say, okay create.
Great.
So now the DNS record was written to Route 53 hosted zone,
and it may take up to 30 minutes for the changes
to propagates and AWS to validate the domain.
So I'll click on next.
And right now we're pending validation.
So we'll just pause the video until this is fully completed.
Okay, so my certificate has now be issued.
And so what I'm going to do now is use it.
And for this, we'll go to Beanstalk and we'll try to create
an environment that leverages that certificate.
So I'm going to do action, create environment.
It's going to be a web server environment,
click on select and for the domain,
I'll just keep the auto-generated value.
And I will choose a Node.js and I will choose
a simple application, but I will configure more options.
And in there, I'm going to go the paid route,
so I'm going to choose high availability
so that a load balancer is provisioned for me.
And in the load balancer configuration,
I'm going to modify it.
I'll choose an application load balancer.
And here I will add listeners.
So, add a listener.
The port is going to be 443,
and the protocol is going to be HTTPS.
And this is how we're going to load a certificate.
So it says, okay, which SSL certificate
would you like to load?
I would like to load the one that was just provisioned,
acm-demo.stephanetheteacher.com.
Excellent.
And the SSL policy is how strong do you want
your SSL policy to be.
I will choose the strongest,
which is the very last one.
But if you want it to support older clients
like Internet Explorer 5 or whatever,
you would choose a lower SSL security policy.
So in this one,
I'll just choose the highest ELB security policy.
Click on add and we're good.
Now I can even disable HTTP if I want it to,
but I'll just keep it for now.
And in terms of the rules,
everything looks good.
Let's scroll down.
Yep, everything looks perfect.
So let's go.
So this is all my custom configuration
and I'll create my environment right now.
So this is going to create just a very simple
Beanstalk application with a load balancer.
But now the specificity is that the load balancer
should have an SSL certificate on it
and we should be able to access our environment from there.
So let's wait for Beanstalk to be provisioned
and then we'll see what happens.
Okay, so my Beanstalk application has been created.
As we can see, I can click on this
and we have the congratulations.
And here, the URL is definitely not what we want
and it's also not secure.
So what do we have to do?
If you remember this course correctly,
we will have to create a CNAME record first
to have the right domain point to this.
So let's go back to our services
and I'm gonna go to Route 53.
And in there, I'm going to go to my hosted zone,
my domain, click create record sets,
and this is going to be a CNAME.
I think I called my acm-demo for my SSL certificate.
So, acm-demo.stephanetheteacher.com.
And the value of it is going to be this, right here.
So we have created a CNAME record, and here we go.
So now that means that I should be able to access my website
using acm-demo.stephanetheteacher.com.
So let's have a look and see if that works.
acm-demo.stephanetheteacher.com.
Okay, here we go.
So, we have access now to our Beanstalk environments
using this URL.
But it's still not secure.
It's because right now I only have forced HTTP,
but if I do HTTPS slash, slash, boom, here we go.
It works.
And we have a little luck here saying the connection
is secure.
That's because the SSL certificate get generated
and it's valid.
And if I click here, it's a Chrome feature.
It says that it was issued by Amazon and it is fully working
so I can get the details and so on.
And it is valid until Saturday, July 25th, 2020.
And it will be automatically renewed by Amazon
in case we need to.
So this is really good.
That means that ACM did provision our SSL certificates.
And finally, we can just verify that if we go to here,
so let's refresh this.
It says that now my certificate is in use.
And if we go here and see what it's in used by,
we need to go actually to the ELB service.
So we'll go to EC2 console and on our EC2 console,
I'll go to my load balancers,
find my Beanstalk balancer that was just created,
which is one of these two.
So let's have a look.
Is it this one?
Let's see the listeners.
No, it's not this one.
Is it this one?
Yes, it is.
So now we can see, we have two listeners.
We have port 80 and port 443.
And in this case, 443 is HTTPS.
So we have a security policy that we did apply.
And we did add the SSL certificates directly from ACM.
And we can click on view/edit certificates if we wanted to,
to just change the certificates.
So that's it.
Hopefully really helpful, but in the end,
we did manage our own application using Beanstalk and HTTPS,
which is a cool demo to do.
I hope you liked it and I will see you in the next lecture.