Where TLS ends

You are the request. Watch where the letter gets opened, and who checks each ID.

sealed letter = TLSpostcard = plain HTTPID card = certificate

Load balancerWhat sits in front of the service.

ALBOpens the letter and reads the path.NLB, TCP listenerHands the letter over unopened.

Target group protocolWhat the ALB sends on to Go.not applicableAn NLB TCP listener only forwards bytes.

HTTPThe ALB sends Go a postcard.HTTPSThe ALB seals a new letter for Go.

Go server listens onWhat the Go server can read.

HTTP :80Postcards only, no ID.HTTPS, self-signedOpens letters; ID made with openssl.HTTPS, real certificateOpens letters; ID from Let's Encrypt or ACM exportable.

sealed letterTLS, :443

postcardplain HTTP, :80, inside the VPC

Browser

ALBApplication LB

Go serverin an ECS task

you start hereopens the letter, reads the pathreads postcards, :80

1certificate, on the ALB

L7 routingyes: path and header rules

ALB's IDhop 1

ACM certificate

The browser checks it: accepted.

filesStay inside ACM. You only get an ARN; the ALB reads the certificate there, and the private key never reaches you.

Go's ID

No ID on Go

A postcard needs no ID.

The browser gets200 OK

The default. The ALB opens the letter, reads the path, and passes Go a postcard inside the VPC. One certificate, and only the browser checks it.

The target group protocol matches what Go speaks: HTTP.

sealed letterTLS, :443

postcard, but Go wants a letterplain HTTP to :443

Browser

ALBApplication LB

Go serverin an ECS task

you start hereopens the letter, reads the pathaccepts only letters, :443

2set up, only the ACM one used

L7 routingyes: path and header rules

ALB's IDhop 1

ACM certificate

The browser checks it: accepted.

filesStay inside ACM. You only get an ARN; the ALB reads the certificate there, and the private key never reaches you.

Go's ID

Self-signed certificate

Go never shows it, because postcards need no ID.

filesfullchain.pem (certificate) and privkey.pem (private key). You put both into the container.

The browser gets Go's reply, passed on by the ALB400 Bad Request

The ALB sends a postcard to :443, but Go only accepts sealed letters on that port. Go replies 400: “Client sent an HTTP request to an HTTPS server.” The ALB passes valid target responses on to the browser, errors included.

Go's 400: tested locally with curl. The ALB passing it on: from the ALB troubleshooting docs, not tested on a real ALB.

sealed letterTLS, :443

postcard, but Go wants a letterplain HTTP to :443

Browser

ALBApplication LB

Go serverin an ECS task

you start hereopens the letter, reads the pathaccepts only letters, :443

2set up, only the ACM one used

L7 routingyes: path and header rules

ALB's IDhop 1

ACM certificate

The browser checks it: accepted.

filesStay inside ACM. You only get an ARN; the ALB reads the certificate there, and the private key never reaches you.

Go's ID

Real certificate

Go never shows it, because postcards need no ID.

filesfullchain.pem (certificate) and privkey.pem (private key). You put both into the container.

The browser gets Go's reply, passed on by the ALB400 Bad Request

Go's 400: tested locally with curl. The ALB passing it on: from the ALB troubleshooting docs, not tested on a real ALB.

sealed letterTLS, :443

a letter Go can't openTLS to :80, Go reads only postcards

Browser

ALBApplication LB

Go serverin an ECS task

you start hereopens, reads, seals a new onereads only postcards, :80

1certificate, on the ALB

L7 routingyes: path and header rules

ALB's IDhop 1

ACM certificate

The browser checks it: accepted.

filesStay inside ACM. You only get an ARN; the ALB reads the certificate there, and the private key never reaches you.

Go's ID

No ID on Go

Without one, Go can't open the ALB's letter.

The browser gets, from the ALB502 Bad Gateway

The article's bug. On port 80 the ALB hands Go a sealed letter, but Go only reads postcards and can't open it. The ALB gets nothing usable back, so it returns 502.

The ALB troubleshooting docs list this as a 502 cause: an SSL handshake error when connecting to a target.

sealed letterTLS, :443

new envelope, new sealTLS again, :443

Browser

ALBApplication LB

Go serverin an ECS task

you start hereopens, reads, seals a new oneopens the letter, :443

2certificates, so the two letters carry different seals

L7 routingyes: path and header rules

ALB's IDhop 1

ACM certificate

The browser checks it: accepted.

filesStay inside ACM. You only get an ARN; the ALB reads the certificate there, and the private key never reaches you.

Go's IDhop 2

Self-signed certificate

The ALB takes it without looking, so self-signed works.

filesfullchain.pem (certificate) and privkey.pem (private key). You put both into the container.

The browser gets200 OK

Re-encryption. The ALB opens the letter, reads it, then seals a new envelope for Go, so two certificates are in use. The ALB doesn't check Go's, so self-signed works.

ALB target group docs: the ALB doesn't validate target certificates, so self-signed or expired ones work.

sealed letterTLS, :443

new envelope, new sealTLS again, :443

Browser

ALBApplication LB

Go serverin an ECS task

you start hereopens, reads, seals a new oneopens the letter, :443

2certificates, so the two letters carry different seals

L7 routingyes: path and header rules

ALB's IDhop 1

ACM certificate

The browser checks it: accepted.

filesStay inside ACM. You only get an ARN; the ALB reads the certificate there, and the private key never reaches you.

Go's IDhop 2

Real certificate

The ALB takes it without looking, so a real one is no safer.

filesfullchain.pem (certificate) and privkey.pem (private key). You put both into the container.

The browser gets200 OK

Same result as self-signed. The ALB doesn't check Go's ID, so a real certificate makes nothing safer, and you now have renewals to handle.

ALB target group docs: the ALB doesn't validate target certificates, so self-signed or expired ones work.

a letter Go can't openthe NLB hands it over, Go reads only postcards

Browser

NLBNetwork LB, TCP

Go serverin an ECS task

you start herehands it over unopenedreads only postcards, :80

0certificates on the whole path

L7 routingno: the letter stays sealed

NLB

No ID on the NLB

It never opens the letter, so it never shows an ID.

Go's ID

No ID on Go

Without one, Go can't open the browser's letter.

No HTTP response. The browser showsERR_SSL_PROTOCOL_ERROR

The browser sends a sealed letter, the NLB hands it to Go unopened, and Go only reads postcards. No load balancer answers, so there is no 502 either; the browser shows its own error.

Error from headless Chrome against a local Go server that speaks plain HTTP.

one sealed letter, browser to Gothe browser checks Go's ID

Browser

NLBNetwork LB, TCP

Go serverin an ECS task

you start herehands it over unopenedopens the letter, :443

1certificate, on Go

L7 routingno: the letter stays sealed

NLB

No ID on the NLB

It never opens the letter, so it never shows an ID.

Go's IDwhole path

Self-signed certificate

The browser checks it and rejects it: no trusted CA issued it.

filesfullchain.pem (certificate) and privkey.pem (private key). You put both into the container.

A not-secure warningNET::ERR_CERT_AUTHORITY_INVALID

This time the browser checks Go's ID itself. No trusted CA issued it, so the browser stops at a warning page.

Error from headless Chrome against a local Go server with a self-signed certificate.

one sealed letter, browser to Gothe NLB hands it over unopened

Browser

NLBNetwork LB, TCP

Go serverin an ECS task

you start herehands it over unopenedopens the letter, :443

1certificate, on Go

L7 routingno: the letter stays sealed

NLB

No ID on the NLB

It never opens the letter, so it never shows an ID.

Go's IDwhole path

Real certificate

The browser checks it directly: accepted.

filesfullchain.pem (certificate) and privkey.pem (private key). You put both into the container.

The browser gets200 OK

Passthrough. The NLB hands the letter to Go unopened and holds no certificate. Because it never reads the path or headers, it can't route by them.

NLB listener docs: a TCP listener forwards traffic without decrypting it.