Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 14 down vote favorite
5

We use Amazon's CloudFront CDN with custom CNAMEs hanging under the main domain (static1.example.com). Although we can break this uniform appearance and use the original whatever123wigglyw00.cloudfront.net URLs to utilise HTTPS, is there another way?

Do Amazon or any other similar provider offer HTTPS CDN hosting?

Is TLS and its selective encryption available for use somewhere (SNI: Server Name Indication)?

Foot note: assuming that the answer is no, but just in the hope someone knows.

EDIT: Now using Google App Engine https://developers.google.com/appengine/docs/ssl for CDN hosting with SSL support.

share|improve this question

2 Answers

up vote 17 down vote accepted

CloudFront with CNAMEs and HTTPS is not supported, see the first note in the CloudFront CNAME documentation.

I don't think any of the low cost CDNs have support for CNAMEs and HTTPS together, to do that they would have to have some way for you to upload your unencrypted certificate to their CDN network.

share|improve this answer
1  
Or broker in the same way Google offer DNS configuration with Google Apps and eNom/GoDaddy. There is hope in the future with en.wikipedia.org/wiki/Server_Name_Indication I was wondering if any provider had started trialling this ability yet. – Metalshark Jul 26 '10 at 18:55
up vote 8 down vote

As of me writing this (May 23 2012), SSL is supported via the CloudFront distribution URL only. Meaning, you cannot CNAME the SSL URL. Concretely, you can reference an item via SSL as:

https://[distribution].cloudfront.net/picture.jpg

but not:

https://cdn.mydomain.com/picture.jpg

where cdn.mydomain.com is a CNAME to [distribution].cloudfront.net. At present you will get SSL errors.

This means you are unable to use your domain name or SSL cert. This can cause problems with crossdomain policies in the browser as well as add undo complexity to the maintenance of a site.

I have been assured by AWS staff that HTTPS support for distribution CNAMEs is on their feature list but that it needs community support for prioritization. To help in this effort please fill out the CloudFront survey (see below) and note this feature request. AWS staff use data gathered from the survey for planning and prioritizing the CloudFront roadmap.

Be sure to note that HTTPS CNAME support is needed when you take the CloudFront Survey: http://aws.qualtrics.com/SE/?SID=SV_9yvAN5PK8abJIFK

EDIT: Noticed a post from June 11, 2012 that AWS had updated the survey link:

New Survey Link: http://aws.qualtrics.com/SE/?SID=SV_e4eM1cRblPaccFS

I think it is worth the time to provide them feedback about making CNAME + SSL a supported feature.

share|improve this answer
Google App Engine now offers it. – Metalshark Jul 11 '12 at 7:30
@Metalshark, do you know of a source documenting this feature of Google App Engine? – John Mark Mitchell Jul 12 '12 at 2:29
I updated the URLs to the survey above. As I took the survey myself I noted that they added a feature ranking exercise. 1 of the 13 suggested features is "CNAME support over HTTPS (custom SSL certificates) - Ability to use custom CNAMEs for SSL traffic delivered over HTTPS." We are on the radar...NOW GET VOTING. – John Mark Mitchell Jul 12 '12 at 5:48
3  
developers.google.com/appengine/docs/ssl documents it. After 2 years of trying to get AWS to support the feature, being offered a vote on it when a competitor has already released the feature is too little too late. – Metalshark Jul 12 '12 at 8:13
cmon AWS, i agree with @Metalshark and everyone on this thread. I just filled out AWS Cloudfront's absurdly long feedback form to advocate for CNAME-HTTPS but if Google App Engine offers it and this question is 2 years old, you gotta do something ASAP!!! – tim peterson Aug 7 '12 at 17:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.