title: Configuring SSL certificate to SINGLE Elastic Beanstalk TOMCAT instance
body: <p>Im trying to install SSL certificates in my TOMCAT elastic beanstalk EC2 instance. I also want my application listening to HTTPS requests on port 443. As start point I based my solution on <a href="http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-singleinstance-tomcat.html" rel="nofollow noreferrer">this link</a>.</p>
  
  <p>After a while making a lot of tries I could not install my certificate or make port 443 listen to HTTPS requests.</p>
  
  <p>Those are the steps I followed:</p>
  
  <p>1) I build a WAR with a .ebextensions folder at src ROOT,as below</p>
  
  <pre><code> ROOT.war
        |
         WEB-INF
         META-INF
         .ebextensions
             |
              https-instance-single.config
              https-instance.config
  </code></pre>
  
  <p>2) <strong>https-instance.config</strong> file content</p>
  
  <pre><code>packages:
    yum:
      mod_ssl : []
  
  container_commands:
    1killhttpd:
      command: "killall httpd"
      ignoreErrors: true
    2wait:
      command: "sleep 3"
  
  files:
    # Apache HTTPS configuration
    /etc/httpd/conf.d/ssl.conf:
      mode: "000644"
      owner: root
      group: root
      content: |
        LoadModule ssl_module modules/mod_ssl.so
        Listen 443
        &lt;VirtualHost *:443&gt;
          &lt;Proxy *&gt;
            Order deny,allow
            Allow from all
          &lt;/Proxy&gt;
  
          SSLEngine             on
          SSLCertificateFile    "/etc/pki/tls/certs/server.crt"
          SSLCertificateKeyFile "/etc/pki/tls/certs/server.key"
          SSLCipherSuite           EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
          SSLProtocol           All -SSLv2 -SSLv3
          SSLHonorCipherOrder   On
  
          Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
          Header always set X-Frame-Options DENY
          Header always set X-Content-Type-Options nosniff
  
          ProxyPass / http://localhost:8080/ retry=0
          ProxyPassReverse / http://localhost:8080/
          ProxyPreserveHost on
        &lt;/VirtualHost&gt;
  
  
    # Public certificate
    /etc/pki/tls/certs/server.crt:
      mode: "000400"
      owner: root
      group: root
      content: |
        -----BEGIN CERTIFICATE-----
        XXXXXXXXXXXXXXXXXXXXXXXXXXX
        -----END CERTIFICATE-----
  
    /etc/pki/tls/certs/server.key:
      mode: "000400"
      owner: root
      group: root
      content: |
        -----BEGIN RSA PRIVATE KEY-----
        XXXXXXXXXXXXXXXXXXXXXXXXXXX
        -----END RSA PRIVATE KEY-----
  
    /etc/pki/tls/certs/gd_bundle.crt:
      mode: "000400"
      owner: root
      group: root
      content: |
        -----BEGIN CERTIFICATE-----
        XXXXXXXXXXXXXXXXXXXXXXXXXXX
        -----END CERTIFICATE-----
        -----BEGIN CERTIFICATE-----
        XXXXXXXXXXXXXXXXXXXXXXXXXXX
        -----END CERTIFICATE-----
        -----BEGIN CERTIFICATE-----
        XXXXXXXXXXXXXXXXXXXXXXXXXXX
        -----END CERTIFICATE-----
  </code></pre>
  
  <p>3) <strong>https-instance-single.config</strong> file content</p>
  
  <pre><code>Resources:
    sslSecurityGroupIngress: 
      Type: AWS::EC2::SecurityGroupIngress
      Properties:
        GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
        IpProtocol: tcp
        ToPort: 443
        FromPort: 443
        CidrIp: 0.0.0.0/0
  </code></pre>
  
  <p>4) Then I deployed my WAR using elastic beanstalk console (none error message was thrown during the process, at least at console).</p>
  
  <p>After Deployed My war as specified, my web application was running perfectly, but with no SSL configurations and HTTPS requests was not being redirected to port 443. Worse, the application was not even listening to HTTPS requests.</p>
  
  <p>Anyone has a light?? I dont want to use ELB (Elastic load balancer) because Im migrating a bunch of small applications and that would bring me a considerable increase of costs (about 20 dollars per app). </p>