Okay, so now let's talk
about SSL and TLS certificates.
So this is a dumbed down version of how this works.
This is obviously way more complicated
but I want to introduce you to the concepts
in case you don't know it.
And even if you do know SSL and TLS
please watch this lecture, I'm going to talk about SNI,
and I'm going to talk about the integrations
of load balancers.
So bare with me, please.
So an SSL certificates, it allows the traffic
between your clients and your load balancer
to be encrypted while in transit.
This is called in-flight encryption.
So it means the data, as it goes through a network
is going to be encrypted
and only going to be able to be decrypted
by the sender and the receiver.
So SSL refers to Secure Sockets Layer
and it's used to encrypt connections
and TLS is the newer version of SSL
and it refers to Transport Layer Security.
But the thing is nowadays,
TLS certificates are the one that are mainly used,
but people, including myself,
I will still refer this as SSL.
So I'm making a mistake, but I'm making it on purpose, okay?
So it's better to say a TLS certificate
than SSL certificate, but for many reasons,
I'm still going to say SSL 'cause it's easier to understand.
So public SSL certificates are issued
by certificate Authorities
and they include something like Comodo, Symantec,
GoDaddy, GlobalSign, Digicert, Letsencrypt and so on.
And using this public SSL certificate
attached to our load balancer,
we're able to encrypt the connection
between the clients and the load balancer.
So whenever you go to a website,
for example Google.com or anything, any other website
and you have a lock or a green lock
that means that your traffic is encrypted.
And if traffic is not encrypted
that you'll have a red sign saying,
hey, traffic is not encrypted,
don't put your credit card details,
don't put your login information because it's not secure.
So the SSL certificates,
they have an expiration date that you set
and they must be renewed regularly
to make sure that they're authentic, okay.
So how does it work from a load balancer perspective?
So users connect over HTTPS
and it's S because it's using SSL certificates
and it's encrypted, it's secure,
and it connects over the public internet
to your load balancer
and internally, your load balancer does something
called SSL certificate termination.
And in the backend,
it can talk to your EC2 instance using HTTP.
So not encrypted, but the traffic goes over your VPC
which is prior network and that is somewhat secure.
So the load balancer will load an X509 certificate,
which is called the SSL or TLS server certificates.
And you can manage these SSL certificates in AWS using ACM,
meaning AWS certificates Manager.
So we're not going to view ACM in that lecture
but just to get an idea of what it is.
Now you can also upload your own certificates
to ACM if you wanted to.
And when you set an HTTP listener, you must,
HTTPS listener,
you must specify a default certificate,
then you can add an optional list of certs
to support multiple domains
and clients can use something called SNI
or Server Name Indication
to specify the host name they reach.
Now don't worry, I'm going to explain
what SNI is in details in the next slide,
because it is really, really important
for you to understand what it means.
That means that, and you can also finally for HTTPS,
set a specific security policy, if you wanted to,
if to support older versions of SSL and TLS
called also legacy clients.
Okay, so let's talk about SNI 'cause it is so important.
SNI solves a very important problem
which is how do you load multiple SSL certificates
onto one web server in order for that web server
to serve multiple websites?
And there's a newer protocol
that now requires the client to indicate the host name
of the target server in the initial SSL handshake.
So, the client will say
"I want to connect to this website"
and the server will know what certificates to load.
And so this is a newer protocol
and this is something new, not every client supports this.
So it only works when you use the application load balancer
and the network load balancer,
so the newer generations or a CloudFront,
and we'll see what CloudFront is later in this course,
and it does not work when you use the classic load balancer
because it is older generation.
So anytime you see multiple SSL certificates
onto your load balancer, think ALB or NLB.
So as a diagram, what does it look like?
We have our ALB here and we have two target groups.
The first one is www.mycorp.com
and the second one is Domain1.example.com
so the ALB will be routing to these target groups
based on some rules and the rules may be directly linked
in this case, to the host name.
So the ALB will have two SSL certificates,
Domain1.example.com and www.mycorp.com
which corresponds to the corresponding target groups.
Now, the clients connects to our ALB,
it says, I would like www.mycorp.com,
and that is part of server name indication.
And the ALB says, okay, I've seen that you want mycorp.com,
let me use the correct SSL certificates
to fill that request.
So it's going to take the right SSL certificates,
encrypt the traffic and then thanks to the rules
it's going to know to either write
to the correct target group, mycorp.com.
And obviously if you have another client
connecting to your ALB for Domain1.example.com,
then it would be able to pull the right
SSL certificate again and
connect it to the right target group.
So using SNI or Server Name Indication,
you are able to have multiple target groups
for different websites using different SSL certificates.
Excellent, so finally, what is it supported
for SSL certificates?
So, Classic Load Balancer is yes,
you can only support one SSL certificate
and if you want multiple host names
with multiple SSL certificates,
the best way is to use multiple Classic Load Balancer.
For ALB, the v2, you can support multiple listeners
with multiple SSL certificates
and that's the great part of it.
And that uses SNI to make it work,
and we just saw what it is.
And for the NLB or Network Load Balancer,
it supports again multiple listeners
with multiple SSL certificates
and it will use SNI again to make it work.
Okay, so let's look at the Classic Load Balancer.
And if we go to listeners,
here I'm able to edit and add an HTTPS listener
and I need you to set up a cipher,
which is the protocols we want to support
and that's a security cipher.
And then I need to set up an SSL certificate
and I can import it directly
and have it here manually encoded.
Or I can choose a certificates from ACM
which is Amazon certificate Manager
but we don't have one yet, so we can't use it,
but I wanted to show you that yes,
you can set up an HTTPS certificate in here
and it supports only one SSL certificate.
So that is for the Classical Load Balancer.
Next for the Application Load Balancer,
we can add another listener as well.
So we'll say, okay, this listener is HTTPS
and the default action is to
forward to our target group, excellent.
Now we set a security policy, this one,
and then we say, what is the default SSL certificate?
So is it from ACM, from IAM or import?
Okay, and we can choose a certificate we want,
but the idea is that now for each rule
we can have a different SSL certificate
and that would allow us using server name indication SNI,
to have multiple SSL certificates
on different target groups.
So very, very good.
But again, I'm not going to do it
because we don't have the right certificates in place.
And for NLB, listener, again, you can add a listener
and this one can be TLS for secure TCP.
And again, the default SSL certificates we have
can be imported from ACM, IAM or written manually.
All right, so that's it for this lecture.
So just to show you how the settings work.
So what I want you to remember is that
the CLB is the old way of doing things,
it does not support SNI
and ALB and NLB do support SNI
and multiple SSL certificates.
All right, that's it,
I will see you in the next lecture.