Enabling SSL Offloading for WordPress Blog Posts in AWS GovCloud

Public sector organizations such as educational institutions need to be able to securely host web applications. Using AWS and open source content management systems like WordPress, users can create secure web applications in the AWS GovCloud (US) isolated regions for public sector organizations. WordPress is a popular, easy-to-use, open source tool for blogging and hosting content on the web, and as of 2021, 62% of the top fastest-growing companies in the United States use WordPress. Amazon Route 53 is an AWS Managed Service. It is a highly available and scalable Domain Name System (DNS) web service designed to give developers and businesses a reliable and cost-effective way to route end users to internet applications.

In this post, I will show you how to use the resources above to secure traffic between your WordPress site running in the AWS GovCloud (US) Regions and on Amazon Elastic Compute Cloud (Amazon EC2). I will use Route 53 for HTTPS TLS traffic and a public certificate requested in AWS Certificate Manager (ACM). However because Route53 is not yet available in the AWS GovCloud (US) Regions, the DNS for your site will be hosted through the commercial account. This solution will also use an Application Load Balancer for SSL offloading with potential options for an auto scaling group.

Sample architecture

Below is an example of how this architecture would look utilizing the described solution in this post’s introduction. Users would connect to the custom DNS managed through Route 53 in the commercial account, but would authenticate into the application hosted in the AWS GovCloud (US) account with certificates hosted in the same account.

Prerequisites

This post assumes that the following prerequisites are in place:

• The user has already installed and configured WordPress on Amazon EC2 with Amazon Relational Database Service (Amazon RDS)
• On your instance, you have a healthy .html file for Health Checks
• Have access to both the AWS GovCloud (US) Account and Commercial AWS Account

Walkthrough

The walkthrough is broken up into the seven following steps:

1. Create a Route 53 hosted zone in the commercial account
2. Request a public certificate within ACM
3. Add certificate Canonical Name Record (CNAME) values to Route 53
4. Create a target group and add your instance(s) to the target group
5. Create an Application Load Balancer with HTTPS for SSL offloading
6. Modify EC2 instance’s wpconfig.php file
7. Connect to your website via HTTPS.

1. Create Route 53 hosted zone in the commercial account

First, we will need to create the Route 53 hosted zone from within the commercial account. Because Route53 is a global service, you must log in to the Route53 console using your standard AWS credentials.

To do that, you’ll need to do the following:

1. 1. Access the AWS Console from your standard AWS account.
   2. Navigate to the Amazon Route 53 Service console.
   3. Select Hosted Zones and select Create Hosted Zone.
   4. Give your domain a name—I used lastname.example.org—and a description.
   5. Make it a public hosted zone, add any tags you wish, and then select Create.
   6. Make a note of the domain name, as we’ll use this for the certificate creation.

2. Request a public certificate within ACM

We will need to sign in to the console using our AWS GovCloud (US) credentials in order to create the public certificate for our WordPress host. Next, we will create the certificate for SSL Traffic.

1. Navigate to the ACM console from your AWS GovCloud (US) account.
2. Select Request Certificate.
3. Select Request a Public Certificate. Then, select Next.
4. Enter in the fully qualified domain name from above and include an asterisk (*) before it. Using the example above, the final result would be *.lastname.example.org.
5. Select DNS Validation or Email Validation. Since we’re creating this through Route 53, we’ll have the autonomy to modify the DNS URL.
6. Provide tags, if necessary, and select Request.
7. Wait for the certificate request to be completed.
8. Once the domain is requested with a Success status, make note of the CNAME name and CNAME value as we’ll need these for Route 53.

3. Add certificate CNAME values to Route 53

Next, we will be creating the CNAME values within Route 53 and associated these with the certificate we created in the step above.

1. Navigate to the Route 53 console using your standard AWS credentials in your commercial account.
2. Select Create Record.
3. For record type, choose CNAME.
4. For record name, provide the CNAME name from Step 8 in Section 2.
5. For Value, provide the CNAME value from Step 8 in Section 2.
6. In this example, we’ll keep simple routing.
7. Select Save.

4. Create a target group and add your EC2 instance

Before the load balancer is created, a target group needs to be created for SSL Certificate offloading.

1. Navigate to the Amazon EC2 console from using your AWS GovCloud (US) credentials. Select Target Groups on the left pane.
2. Select Create Target Groups.
3. For this example, select Instances.
4. Give the target group a name, and keep the protocol at HTTP on Port 80.
5. Under Health Checks, keep the protocol as HTTP and provide the HTML file for your health checks. In this example, I used /healthy.html.
6. Select Next.
7. Under Register Targets, register your WordPress EC2 instance.
8. Then, create the target group.

5. Create your Application Load Balancer for HTTPS traffic to your target group and modify Route 53

Now that the target group has been created, an Application Load Balancer can be created and associated with the target group. Then, we will take the address of the load balancer and associate it with the Route 53 hosted zone.

1. 1. Navigate to the Amazon EC2 console from using your AWS GovCloud (US) credentials. Select Elastic Load Balancers on the left pane.
   2. Select Create Load Balancer, and then select Create Application Load Balancer.
   3. Give your load balancer a name. I used MyWordpressGovCloudLB.
   4. Keep the type under Scheme and IP Address the same for this example. Under Network Mapping, select your virtual private cloud (VPC).
   5. Map the Application Load Balancer to at least Availability Zones, and a subnet within those Availability Zones.
   6. Under Listeners, change Protocol to HTTPS.
   7. For Default Action, Forward to, select your target group from Step H above.
   8. Under Secure Listening Settings, keep Security Policy at ELBSecurityPolicy-2016-08.
   9. For Default SSL Certificate, make sure From ACM is selected and select the certificate you requested at the beginning of this post.
   10. Provide tags, if desired, and create the load balancer.
   11. Take note and copy the DNS Name under Description. We’ll need this for the Route 53 entry.
   12. Navigate back to the Route 53 console and to your Hosted Zone and domain name. Select Create Record.
   13. Provide a name for your website under Record Name, and keep the Record Type as A and Routing Policy as Simple Routing.
   14. Select Alias toward the right of Quick Create Record. Under Route traffic, change the following drop downs:
       1. For Choose Endpoint, select Alias to Application and Classic Load Balancer.
       2. For Choose Region, select the GovCloud Region you’re launching in. In my case, it was us-gov-east-1.
       3. For Choose Load Balancer, paste in the DNS Name of your Application Load Balancer.
   15. Create your record. Make sure to take note of the DNS Name.

6. Modify your EC2 Instance’s wp-config.php file

Now that the resources are created for SSL offloading, the WordPress configuration file will need to be edited in order for HTTPS traffic to be accepted and successfully connect.

1. Log in to your Amazon EC2 instance using your SSH (Secure Shell) credentials.
2. Navigate to your wp-config.php file. For me, this file was in the directory /var/www/html and open this file with a preferred editor of your choosing.
3. Navigate below to the beginning portion of the PHP file and add the following snippets of code. These will explicitly provide your DNS record names you made within Route53.

define(‘WP_SITEURL’, ‘https://mydns.route53.url/’)

define(‘WP_HOME’, ‘https://mydns.route53.url/’)

4. Toward the bottom of the wp-config.php file, above the “That’s All” portion, provide the following code. This will allow and force WordPress to use HTTPS forwarding for your WordPress blog to secure connections back and forth to your site.

/** SSL */

define('FORCE_SSL_ADMIN', true);

// in some setups HTTP_X_FORWARDED_PROTO might contain

// a comma-separated list e.g. http,https

// so check for https existence

if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)

$_SERVER['HTTPS']='on';

5. Make sure to save the file and restart the apache service with the following command: sudo servicectl apache restart.

7. Navigate to your secured, unique WordPress blog post

Once the above is done, you should be able to access your WordPress blog using your unique URL created in Route 53. The URL should also be available via HTTPS for secure connections with the certificate being offloaded onto the load balancer.

You can also experiment with creating an auto scaling group and putting this behind the load balancer for increased scalability and availability. AWS documentation details how to accomplish this.

Exploration and cleanup

Now that the WordPress site is working with HTTPS, you may want to continue to configure your website and modify these resources for web hosting. If working with these services for testing or to maintain proper cloud hygiene, please clean up your resources. Follow the cleanup instructions. Additionally, delete your target group and Application Load Balancer, Route53 DNS entries and hosted zone, as well as your certificate hosted within ACM.

Conclusion

In this blog post, we used Amazon EC2, Route 53, ACM, and Elastic Load Balancing to create a secure WordPress site within AWS GovCloud (US). There are additional configurations you can add to your blog post to ensure high availability and resiliency such as creating an auto scaling group within your Amazon EC2 console. For details on how to do this, please read the documentation on Amazon EC2 Auto Scaling.