Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

We use Amazon's CloudFront CDN with custom CNAMEs hanging under the main domain (static1.example.com). Although we can break this uniform appearance and use the original whatever123wigglyw00.cloudfront.net URLs to utilise HTTPS, is there another way?

Do Amazon or any other similar provider offer HTTPS CDN hosting?

Is TLS and its selective encryption available for use somewhere (SNI: Server Name Indication)?

Foot note: assuming that the answer is no, but just in the hope someone knows.

EDIT: Now using Google App Engine https://developers.google.com/appengine/docs/ssl for CDN hosting with SSL support.

share|improve this question

2 Answers 2

up vote 17 down vote accepted

CloudFront with CNAMEs and HTTPS is not supported, see the first note in the CloudFront CNAME documentation.

I don't think any of the low cost CDNs have support for CNAMEs and HTTPS together, to do that they would have to have some way for you to upload your unencrypted certificate to their CDN network.

share|improve this answer
2  
Or broker in the same way Google offer DNS configuration with Google Apps and eNom/GoDaddy. There is hope in the future with en.wikipedia.org/wiki/Server_Name_Indication I was wondering if any provider had started trialling this ability yet. –  Metalshark Jul 26 '10 at 18:55

PLEASE NOTE THE EDITS & UPDATES BELOW

As of me writing this (May 23 2012), SSL is supported via the CloudFront distribution URL only. Meaning, you cannot CNAME the SSL URL. Concretely, you can reference an item via SSL as:

https://[distribution].cloudfront.net/picture.jpg

but not:

https://cdn.mydomain.com/picture.jpg

where cdn.mydomain.com is a CNAME to [distribution].cloudfront.net. At present you will get SSL errors.

This means you are unable to use your domain name or SSL cert. This can cause problems with crossdomain policies in the browser as well as add undo complexity to the maintenance of a site.

I have been assured by AWS staff that HTTPS support for distribution CNAMEs is on their feature list but that it needs community support for prioritization. To help in this effort please fill out the CloudFront survey (see below) and note this feature request. AWS staff use data gathered from the survey for planning and prioritizing the CloudFront roadmap.

Be sure to note that HTTPS CNAME support is needed when you take the CloudFront Survey: http://aws.qualtrics.com/SE/?SID=SV_9yvAN5PK8abJIFK

EDIT: Noticed a post from June 11, 2012 that AWS had updated the survey link:

New Survey Link: http://aws.qualtrics.com/SE/?SID=SV_e4eM1cRblPaccFS

I think it is worth the time to provide them feedback about making CNAME + SSL a supported feature.

EDIT: Announced on June 11, 2013, custom SSL Certs with dedicated IPS are now supported with CloudFront on AWS:

See the feature announcement on the AWS Blog: http://aws.typepad.com/aws/2013/06/custom-ssl-domain-names-root-domain-hosting-for-amazon-cloudfront.html

One item of consideration before counting on going this route, you need to see significant value from deviating from the https://[distribution].cloudfront.net route as the pricing is $600 USD per month for hosting custom SSL certs.

EDIT: Announced on March 5, 2014, custom SSL Certs using Server Name Indication (SNI) are now supported with CloudFront on AWS -- NO ADDITIONAL CHARGE:

AWS now supports custom SSL Certs via SNI. This is HUGE as it opens the possibility of leveraging AWS' existing infrastructure (IP addresses). As such, AWS does not charge extra for this service! To learn more, read about it on the AWS blog post: http://aws.typepad.com/aws/2014/03/server-name-indication-sni-and-http-redirection-for-amazon-cloudfront.html

One item that should be noted though, Server Name Indication (SNI) does have some drawbacks that should be considered before relying on it completely. In particular it is not supported by some older browsers. If want to understand this better, see: http://stackoverflow.com/questions/5154596/is-ssl-sni-actually-used-and-supported-in-browsers

share|improve this answer
    
Google App Engine now offers it. –  Metalshark Jul 11 '12 at 7:30
    
@Metalshark, do you know of a source documenting this feature of Google App Engine? –  John Mark Mitchell Jul 12 '12 at 2:29
    
I updated the URLs to the survey above. As I took the survey myself I noted that they added a feature ranking exercise. 1 of the 13 suggested features is "CNAME support over HTTPS (custom SSL certificates) - Ability to use custom CNAMEs for SSL traffic delivered over HTTPS." We are on the radar...NOW GET VOTING. –  John Mark Mitchell Jul 12 '12 at 5:48
3  
developers.google.com/appengine/docs/ssl documents it. After 2 years of trying to get AWS to support the feature, being offered a vote on it when a competitor has already released the feature is too little too late. –  Metalshark Jul 12 '12 at 8:13
    
cmon AWS, i agree with @Metalshark and everyone on this thread. I just filled out AWS Cloudfront's absurdly long feedback form to advocate for CNAME-HTTPS but if Google App Engine offers it and this question is 2 years old, you gotta do something ASAP!!! –  tim peterson Aug 7 '12 at 17:04

protected by Community Mar 14 at 14:28

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.