# AWS ELB offload wildcard certificate with Kong Ingress Controller + Websocket

**URL:** <https://discuss.konghq.com/t/aws-elb-offload-wildcard-certificate-with-kong-ingress-controller-websocket/2426>\
**Category:** Questions\
**Tags:** kubernetes\
**Created:** [December 12, 2018, 3:23pm UTC](https://discuss.konghq.com/t/aws-elb-offload-wildcard-certificate-with-kong-ingress-controller-websocket/2426 "2018-12-12T15:23:57Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![zanhsieh](https://avatars.discourse-cdn.com/v4/letter/z/f04885/32.png) [@zanhsieh](https://discuss.konghq.com/u/zanhsieh)\
**Post date:** [December 12, 2018, 3:23pm UTC](https://discuss.konghq.com/t/aws-elb-offload-wildcard-certificate-with-kong-ingress-controller-websocket/2426/1 "2018-12-12T15:23:57Z")

</div>

Hi,

I have couple requirements need to meet:

- Need to use existed wildcard certificate stored in AWS Certificate Manager, accomplished with AWS ELB (not really care L4 or L7). The certificate was generated from AWS Certificate Manager, therefore no chance to dump its private key.
- Need to serve HTTPS and websocket (wss) traffic at the same time.
- Basic rewrite to K8S service root level required. E.g.  
HTTPS example:  
[External] [https://api0.demo.acme.com/httpbin/whatever](https://api0.demo.acme.com/httpbin/whatever) → [Internal, httpbin service] [http://localhost:8000/whatever](http://localhost:8000/whatever)  
Websocket example:  
[External] wss://stream.acme.com/marketdata/whatever → [Internal, websocket service] ws://localhost:80/whatever

` kubectl apply -f https://bit.ly/kong-ingress`

```
cat <<EOF| k apply -f -
apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
    service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "3600"
    service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*'
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: REDACTED
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: '*'
  name: kong-proxy
  namespace: kong
spec:
  externalTrafficPolicy: Cluster
  ports:
  - name: kong-proxy
    nodePort: 31245
    port: 80
    protocol: TCP
    targetPort: 8000
  - name: kong-proxy-ssl
    nodePort: 32361
    port: 443
    protocol: TCP
    targetPort: 8443
  selector:
    app: kong
  sessionAffinity: None
  type: LoadBalancer

---

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    configuration.konghq.com: default
  name: default
spec:
  rules:
  - host: api0.demo.acme.com
    http:
      paths:
      - backend:
          serviceName: httpbin
          servicePort: 8000
        path: /httpbin
  - host: stream.demo.acme.com
    http:
      paths:
      - backend:
          serviceName: nginx
          servicePort: 80
        path: /marketdata

---

apiVersion: configuration.konghq.com/v1
kind: KongIngress
metadata:
  name: default
proxy:
  path: /
route:
  strip_path: true
EOF

```

But when I curl it, it keeps return 400 Bad Request

```
$ curl https://api0.demo.acme.com/httpbin/ -vvvv
* Trying 1.2.3.4...
* TCP_NODELAY set
* Connected to api0.demo.acme.com (1.2.3.4) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: CN=*.demo.acme.com
* start date: Dec 7 00:00:00 2018 GMT
* expire date: Jan 7 12:00:00 2020 GMT
* subjectAltName: host "api0.demo.acme.com" matched cert's "*.demo.acme.com"
* issuer: C=US; O=Amazon; OU=Server CA 1B; CN=Amazon
* SSL certificate verify ok.
> GET /httpbin/ HTTP/1.1
> Host: api0.demo.acme.com
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< Date: Wed, 12 Dec 2018 13:23:56 GMT
< Content-Type: text/plain; charset=UTF-8
< Content-Length: 12
< Connection: close
< Server: kong/0.14.1
<
Bad request
* Closing connection 0
* TLSv1.2 (OUT), TLS alert, Client hello (1):

```

What I do wrong? Please advice. Thanks.

Also the K8S version I used is v1.10.6 (KOPS stable). K8S API server on the master has following admission control enabled:

```
- Initializers
- NamespaceLifecycle
- LimitRanger
- ServiceAccount
- PersistentVolumeLabel
- DefaultStorageClass
- DefaultTolerationSeconds
- NodeRestriction
- ResourceQuota
- AlwaysPullImages
- DenyEscalatingExec

```

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [December 14, 2018, 7:32pm UTC](https://discuss.konghq.com/t/aws-elb-offload-wildcard-certificate-with-kong-ingress-controller-websocket/2426/2 "2018-12-14T19:32:05Z")

</div>

Are the ports and protocol getting mixed up?

client -\> AWS ELB is HTTPS but what is the protocol being used between AWS ELB -\> Kong?

---

<div class="post-metadata">

**Author:** ![zanhsieh](https://avatars.discourse-cdn.com/v4/letter/z/f04885/32.png) [@zanhsieh](https://discuss.konghq.com/u/zanhsieh)\
**Post date:** [December 15, 2018, 1:06am UTC](https://discuss.konghq.com/t/aws-elb-offload-wildcard-certificate-with-kong-ingress-controller-websocket/2426/3 "2018-12-15T01:06:55Z")

</div>

@hbagdi

Thanks for reply.

Originally I thought it should be TCP since have successful case in k8s nginx-ingress-controller. What do you recommend?

// M

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [December 19, 2018, 3:23am UTC](https://discuss.konghq.com/t/aws-elb-offload-wildcard-certificate-with-kong-ingress-controller-websocket/2426/4 "2018-12-19T03:23:30Z")

</div>

Is it possible that HTTP and HTTPS are getting mixed up between the ELB and Kong?

---

<div class="post-metadata">

**Author:** ![kainlite](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/kainlite/32/715_2.png) [@kainlite](https://discuss.konghq.com/u/kainlite)\
**Post date:** [January 18, 2019, 10:27pm UTC](https://discuss.konghq.com/t/aws-elb-offload-wildcard-certificate-with-kong-ingress-controller-websocket/2426/5 "2019-01-18T22:27:57Z")

</div>

Were you able to get this working?, I’ve been trying without success, the ELB doesn’t even pick the certificate, I get an ELB with 2 TCP, while it works there is no cert assigned.

---

<div class="post-metadata">

**Author:** ![zanhsieh](https://avatars.discourse-cdn.com/v4/letter/z/f04885/32.png) [@zanhsieh](https://discuss.konghq.com/u/zanhsieh)\
**Post date:** [January 19, 2019, 5:03am UTC](https://discuss.konghq.com/t/aws-elb-offload-wildcard-certificate-with-kong-ingress-controller-websocket/2426/6 "2019-01-19T05:03:23Z")

</div>

@kainlite Try this

```
cat <<EOF| k apply -f -
apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
    service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "3600"
    service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*'
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: REDACTED
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: '*'
  name: kong-proxy
  namespace: kong
spec:
  externalTrafficPolicy: Cluster
  ports:
  - name: kong-proxy-ssl
    nodePort: 32361
    port: 443
    protocol: TCP
    targetPort: 8000
  selector:
    app: kong
  sessionAffinity: None
  type: LoadBalancer
EOF

```

Although I switched to other vendor provided ingress already.

// M

---

<div class="post-metadata">

**Author:** ![kainlite](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/kainlite/32/715_2.png) [@kainlite](https://discuss.konghq.com/u/kainlite)\
**Post date:** [January 21, 2019, 3:09pm UTC](https://discuss.konghq.com/t/aws-elb-offload-wildcard-certificate-with-kong-ingress-controller-websocket/2426/7 "2019-01-21T15:09:49Z")

</div>

Awesome, Thank you @zanhsieh, that annotation in the kube-proxy did the trick, I’m now struggling with the ELB to serve http and https, this is really confusing.

---

<div class="post-metadata">

**Author:** ![ldipotet](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/ldipotet/32/4842_2.png) [@ldipotet](https://discuss.konghq.com/u/ldipotet)\
**Post date:** [July 12, 2019, 8:38am UTC](https://discuss.konghq.com/t/aws-elb-offload-wildcard-certificate-with-kong-ingress-controller-websocket/2426/9 "2019-07-12T08:38:56Z")

</div>

Finally did you get any solution in this point? It’s bee really complicated something that should be easy … 2 days and we haven’t find any solution .

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [July 12, 2019, 3:26pm UTC](https://discuss.konghq.com/t/aws-elb-offload-wildcard-certificate-with-kong-ingress-controller-websocket/2426/10 "2019-07-12T15:26:09Z")

</div>

@ldipotet I recommend opening a new post for your issue with relevant details so that we can help you debug.  
Mixing up topics in the same thread leads to confusion.