Why won't my site connect via https with this little dns trick?

Question

I'm using an AWS pattern to host a flat website at example.com. It goes like this:

1. S3 bucket configured like a website

2. CloudFront distribution pointing at the S3 bucket with an SSL certificate for the example.com

3. Route53 hosted zone with the A record aliased to the CloudFront distribution.

This all works very well!

However:

When I have a client that needs to control their own DNS (i.e. can't use my Route53 DNS) then I have to figure out a way to configure their DNS (e.g. GoDaddy) to route traffic to my CloudFront domain.

This is a problem because GoDaddy does not allow aliasing an A record to another domain. Some do but GoDaddy doesn't. So I have to use a trick:

1. Create a CNAME for www.example.com pointing to my CloudFront domain.

2. Create a 'forward' to redirect 301 all requests to www.example.com.

This works a treat for HTTP requests. But HTTPS requests hang and eventually gives ERR_CONNECTION_TIMED_OUT. If I do the same thing on Enom I get ERR_ADDRESS_UNREACHABLE.

Please note that I do have a certificate and have HTTPS connections allowed on CloudFront so this is very puzzling to me.

Answer 1

A. Create a CNAME for www.example.com pointing to my CloudFront domain.

That's all you need to do.

B. Create a 'forward' to redirect 301 all requests to www.example.com.

? From where? This makes no sense.

The only reason for Cloudfront not to respond is because you've not configured it correctly.

Answer 2

Yes yes, the cloudfront is fine and https://www.example.com resolves well.

It turns out that we needed to use an an ALIAS record which only some DNS providers support. Route53 does this which we normally use but cant for some clients.

We started using NameCheap for this reason.