2

I need a static IP address that handles SSL traffic from a known source (a partner). The reason the IP needs to be static is that the partner requires this in order to maintain the PCI compliance.

Our servers are behind an AWS Elastic Load Balancer (ELB), which cannot provide a static IP address; many threads about this here.

My thought is to create an instance in EC2 whose sole purpose in life is to be a reverse proxy server having it's own IP address; accepting HTTPS requests and forwarding them to the load balancer.

Are there better solutions?

Improve this question
4
  • 1
    What's wrong with using the ELB DNS Name instead of IP? Commented Sep 27, 2012 at 22:35
  • I apologize -- I failed to explain why I need to jump through this hoop of getting a static IP address. I have clarified my question. Commented Oct 1, 2012 at 13:57
  • That's the first I've heard of a static IP address being required for anything related to PCI. Besides, even "static" IP addresses change from time to time. Commented Oct 1, 2012 at 14:03
  • It's the first I have heard of it, too, but this is the kind of partner who says "jump" and we ask "how high" :-). When I say "static IP" I mean an IP address (or range) that is assigned to my organization and will be ours until we decide to relinquish it. ISPs and larger companies may request a grant for a block of IPs issued by a government authority (IANA). This ensures that the IP address is unchanged as long as everyone holds up their end of the deal. Amazon's Elastic IP's also meet this criteria for "static IP", despite the implication of their name. Commented Oct 2, 2012 at 14:34

2 Answers 2

Reset to default
4

In the end, I implemented the requirement of our partner as follows:

  • launch an instance in AWS
  • allocate and attach an Elastic IP (EIP) to it
  • Installed Apache
  • (in our case, installed our SSL certificate)
  • Configured Apache as a reverse proxy server, forwarding to a CNAME that pointed to our ELB

Here's a sample Apache virtual host configuration. I turned off NameVirtualHost and specified the address of our EIP. I also disabled a default host. If the partner desires, I will add a <Directory> block that accepts requests only from their IP range.

<IfModule mod_ssl.c> # Catch non-SSL requests and redirect to SSL <VirtualHost 12.34.567.890:80> ServerName our-static-ip-a-record.example.com Redirect / https://our-elb-cname.example.com </VirtualHost> # Handle SSL requests on the static IP <VirtualHost 12.34.567.890:443> ServerAdmin [email protected] ServerName our-static-ip-a-record.example.com # SSL Configuration SSLEngine on SSLProxyEngine on SSLProxyCACertificateFile /etc/apache2/ssl/gd_bundle.crt SSLCertificateFile /etc/apache2/ssl/example.com.crt SSLCertificateKeyFile /etc/apache2/ssl/private.key # Additional defaults, e.g. ciphers, defined in apache's ssl.conf # Where the magic happens ProxyPass / https://our-elb-cname.example.com/ ProxyPassReverse / https://our-elb-cname.example.com/ # Might want this on; sets X-Forwarded-For and other useful headers ProxyVia off # This came from an example I found online, handles broken connections from IE BrowserMatch "MSIE [2-6]" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 # MSIE 7 and newer should be able to use keepalive BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown </VirtualHost> </IfModule>

Hope this saves someone else some time in the future :-)

Improve this answer
3

You don't need a "static" IP address to implement SSL; you do need a name in the DNS, for which the SSL certificate will be issued.

The typical solution to this is to create a name in the DNS and then make it a CNAME for the DNS name given for the Elastic Load Balancer.

Improve this answer
1
  • @Micheal-Hampton -- I am sorry; I failed to explain why I need a static IP. I have clarified my question by adding the second sentence: static IP (or known IP range) is needed to satisfy the partner who maintains PCI compliance. Yeah, getting it to work off ELB along was no problem :-) Commented Oct 1, 2012 at 13:59

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.