AWS ACM 已验证 ALB SSL 问题

Question

我已经使用 ACM 证书将 HTTPS 用于 AWS Application Load Balancer 侦听器。

我从 ACM 请求了子域的 public 证书：test.example.com 并在路由 53 中为其创建了一个 CNAME：

Name: _xxxxxxxxxxx.test.example.com

Type: CNAME

Value: xxxxxx.xxx.acm-validations.aws.

我可以使用ALB的DNS（xxxx.us-east-1.elb.amazonaws.com）在POSTMAN中成功调用API，但是，当我使用 python 请求或 cURL 调用相同的 API 时，它总是会告诉我 SSL 有问题。

cURL:

代码：

curl -X POST \
  https://xxxxx.us-east-1.elb.amazonaws.com/prod/testapi \
  -H 'Content-Type: application/json' \
  -H 'cache-control: no-cache' \
  -d '{
    "paras1": "xxxxx"
}'

错误：

* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=test.example.com
*  start date: Nov 11 00:00:00 2018 GMT
*  expire date: Dec 11 12:00:00 2019 GMT
*  subjectAltName does not match xxxx.us-east-1.elb.amazonaws.com
* SSL: no alternative certificate subject name matches target host name 'xxxx.us-east-1.elb.amazonaws.com'
* Closing connection 0
* TLSv1.2 (OUT), TLS alert, Client hello (1):
curl: (51) SSL: no alternative certificate subject name matches target host name 'xxxx.us-east-1.elb.amazonaws.com'

Python 请求：

代码：

import requests

url = "https://xxxxx.us-east-1.elb.amazonaws.com/prod/testapi"

payload = "{\"paras1\": \"xxxxx\"}"
headers = {
    'Content-Type': "application/json",
    'cache-control': "no-cache"
    }

response = requests.request("POST", url, data=payload, headers=headers)

print(response.text)

错误：

HTTPSConnectionPool(host='xxxx.us-east-1.elb.amazonaws.com', port=443): 
Max retries exceeded with url: /prod/testapi 
(Caused by SSLError(CertificateError("hostname 'xxxx.us-east-1.elb.amazonaws.com' doesn't match 'test.example.com'",),))

Answer 1

显然，您调用 xxxx.us-east-1.elb.amazonaws.com，它设置了 test.example.com 的证书。尽管证书可能有效，但它与您正在调用的 URL 不匹配，这意味着该证书对于此调用无效。 ~~我认为您还必须为 API 网关~~ 设置自定义域。 ~~https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html~~

编辑：感谢您的评论。我不确定如何将 "elb" 解读为 api 网关。我的错。 ELB 的 DNS 仍然必须与证书中的 DNS 相匹配。您可以创建从您的域到 ELB 域的 CNAME。这应该可行（至少我们是这样做的）。

Answer 2

I can use the DNS of ALB (xxxx.us-east-1.elb.amazonaws.com)

这不是它设计的工作方式。你需要test.example.com指向DNS中的ELB，然后：

url = "https://test.example.com/prod/testapi"

AWS ACM 已验证 ALB SSL 问题

AWS ACM verified ALB SSL issue

ssl

ssl-certificate

amazon-web-services

amazon-elb

aws-load-balancer