title: AWS loadbalancer + Nginx + gunicorn - how to use ssl
body: <p>Im trying to use docker-machine to create ec2 instances with the stack nginx+gunicorn+django. I have an internet-facing Application Load balancer with two target groups (green/blue) to prevent any downtime in new deployment (new deployments gets deployed to the unused group, and the load balancer group is changed when everything checks out)</p>
  
  <p>Everything works perfect with port 80, but when I try to add a listener for port 443 with a Amazon Issued Cert for that domain, I can't get it to work. Do I need to obtain certs from inside Nginx also? Do I need Nginx to listen to port 443? Targets?</p>
  
  <p>Loadbalancer:</p>
  
  <pre><code>+------------+-----------------------------+----------------+
  | Listener ID|            Rules.           | SSL Certificate|
  +------------+-----------------------------+----------------+
  | HTTP: 80   | Default: forwarding to blue.| N/A.           |
  +------------+-----------------------------+----------------+
  | HTTPS: 443 | Default: forwarding to blue.|Default: (ACM). |
  +------------+-----------------------------+----------------+
  </code></pre>
  
  <p>Targets:</p>
  
  <pre><code>+------------+--------------+--------------+--------------+---------------+
  |    Name    |     Port     |   Protocol   |  Target type | Load Balancer |
  +------------+--------------+--------------+--------------+---------------+
  | Blue       | 80           | HTTP         | instance     | loadbalancer  |
  +------------+--------------+--------------+--------------+---------------+
  | Green      | 80           | HTTP         | instance     |               |
  +------------+--------------+--------------+--------------+---------------+
  </code></pre>
  
  <p>My Nginx conf:</p>
  
  <pre><code>user  nginx;
  worker_processes  1;
  
  error_log  /var/log/nginx/error.log warn;
  pid        /var/run/nginx.pid;
  
  events {
    worker_connections  1024;
  }
  
  http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
  
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    '$status $body_bytes_sent "$http_referer" '
    '"$http_user_agent" "$http_x_forwarded_for"';
  
    access_log  /var/log/nginx/access.log  main;
  
    sendfile        on;
    #tcp_nopush     on;
  
    keepalive_timeout  65;
  
    upstream app {
      server django:5000;
    }
  
    server {
      listen 80;
      charset utf-8;
  
      location = /favicon.ico {
          return 204;
          access_log     off;
          log_not_found  off;
      }
  
      location / {
          try_files $uri @proxy_to_app;
      }
  
      # django app
       location @proxy_to_app {
          proxy_redirect     off;
          proxy_set_header   Host $host;
          proxy_set_header   X-Real-IP $remote_addr;
          proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header   X-Forwarded-Host $server_name;
          proxy_pass http://app;
      }
    }
  }
  </code></pre>