CloudFront SSL/TLS, HTTPS Policies, and SNI – SAP-C02 Study Guide

Purpose of This Lesson

Amazon CloudFront can secure both sides of a content delivery request:

• The connection from the client to the CloudFront distribution, called the viewer connection.
• The connection from CloudFront to the origin, called the origin connection.

The key design decisions are certificate location, viewer and origin protocol policies, alternate domain names, and whether clients support Server Name Indication (SNI).

Key Concepts

CloudFront certificates and alternate domain names

CloudFront distributions can use the default CloudFront hostname or one or more custom domain names, also called alternate domain names or CNAMEs.

For a custom HTTPS hostname, CloudFront needs a certificate whose names match the requested domain. The certificate can be:

• Issued by AWS Certificate Manager (ACM).
• Imported or obtained from a third-party public certificate authority.

When ACM is used for a CloudFront distribution, the certificate must be requested or imported in US East (N. Virginia), us-east-1. This is a frequent exam detail: CloudFront is a global service, and its ACM integration uses the us-east-1 certificate store.

A certificate in another AWS Region cannot be selected for a CloudFront viewer HTTPS configuration.

Viewer protocol policy

The viewer protocol is the protocol used between the end user and CloudFront. The distribution’s viewer protocol policy determines how CloudFront handles HTTP and HTTPS requests.

Common options include:

• HTTP and HTTPS: Accept both protocols.
• Redirect HTTP to HTTPS: Accept an HTTP request, redirect the client to HTTPS, and then serve the request securely.
• HTTPS only: Require HTTPS and reject or deny HTTP requests rather than redirecting them.

Redirecting is useful when clients initially use HTTP but should be upgraded to HTTPS. Requiring HTTPS is stricter and avoids accepting unencrypted viewer requests altogether.

Origin protocol policy

The origin protocol controls how CloudFront connects to the backend. It is independent of the viewer protocol policy.

For example, a distribution can accept HTTPS from viewers while using HTTP to communicate with an origin. This protects the client-to-CloudFront connection but does not encrypt the CloudFront-to-origin segment.

For end-to-end encryption, configure CloudFront to use HTTPS to the origin and ensure the origin presents a valid public certificate for the hostname CloudFront uses to connect.

HTTPS connections to origins

#### Amazon S3 origins

Amazon S3 supports HTTPS using AWS-managed certificates. The S3 certificate is not managed or replaced by the customer. CloudFront can therefore connect to an S3 origin over HTTPS without the customer installing a certificate on the bucket.

#### Custom origins

Custom origins, such as an Application Load Balancer or an EC2-based web server, must be configured to support HTTPS if CloudFront is set to use HTTPS to the origin.

Examples include:

• Application Load Balancer: Configure an HTTPS listener and attach an ACM certificate appropriate for the load balancer’s Region.
• EC2 or another web server: Install a certificate issued by a public certificate authority and configure the web server for TLS.

For CloudFront origin validation, use a publicly trusted certificate. A private or self-signed certificate is not suitable for the standard CloudFront HTTPS connection to a custom origin.

Server Name Indication (SNI)

SNI allows multiple HTTPS certificates and domain names to share one CloudFront IP address. During the TLS handshake, the client indicates the hostname it is requesting. CloudFront uses that hostname to select the matching certificate.

For example, one distribution or CloudFront HTTPS endpoint may serve:

• www.example.com
• static.example.net

The client includes the requested hostname, and CloudFront selects the certificate that covers that name. This avoids requiring a separate dedicated IP address for every certificate or hostname.

SNI is supported by modern browsers and clients. Very old clients released before approximately 2010 may not support SNI. If legacy compatibility is mandatory, a dedicated-IP custom SSL configuration may be required, which can have additional cost and operational implications.

Architecture Decision Guide

Requirement	Recommended configuration	Important consideration
Use HTTPS for a CloudFront custom domain	Attach a matching ACM certificate or public third-party certificate	ACM certificate must be in us-east-1
Permit both HTTP and HTTPS	Viewer protocol policy: HTTP and HTTPS	Traffic may remain unencrypted from the viewer
Upgrade HTTP users automatically	Viewer protocol policy: Redirect HTTP to HTTPS	Adds a redirect before the secure request
Reject all HTTP viewer requests	Viewer protocol policy: HTTPS only	Strongest viewer-side enforcement
Encrypt CloudFront-to-S3 traffic	Origin protocol: HTTPS	S3 supplies its own public certificate
Encrypt CloudFront-to-ALB traffic	HTTPS origin protocol and HTTPS ALB listener	Attach a valid certificate to the ALB listener
Encrypt CloudFront-to-EC2 traffic	HTTPS origin protocol and a properly configured web-server certificate	Certificate must be publicly trusted and match the origin hostname
Serve multiple domains cost-effectively	Use SNI with matching certificates	Clients must support SNI
Support very old non-SNI clients	Use a dedicated-IP custom SSL option where available	Higher cost and legacy-client tradeoff

Exam-Relevant Takeaways

• ACM certificates used by CloudFront must be in us-east-1, regardless of where the application or origin runs.
• CloudFront supports certificates from ACM and public third-party certificate authorities.
• A custom CloudFront domain requires an appropriate certificate covering that domain.
• Viewer protocol policy controls client-to-CloudFront traffic.
• Origin protocol policy controls CloudFront-to-origin traffic.
• Viewer HTTPS does not automatically mean that the origin connection uses HTTPS.
• For HTTPS custom origins, use publicly trusted certificates.
• S3 already provides its HTTPS certificate; customers do not install one on S3.
• SNI lets multiple domain names and certificates share a CloudFront IP address.
• Dedicated IP support is relevant primarily for old clients that do not support SNI.

Common Exam Traps

• Choosing an ACM certificate from the application’s Region: CloudFront requires the certificate in us-east-1, even if the ALB or EC2 origin is elsewhere.
• Assuming HTTPS to CloudFront secures the origin: Viewer and origin protocols are separate settings.
• Using a private CA certificate for a custom origin: CloudFront expects a publicly trusted origin certificate for standard HTTPS origin validation.
• Trying to install a certificate on S3: S3 manages the certificate for its HTTPS endpoint.
• Assuming SNI is an origin feature: In this context, SNI enables CloudFront to select among viewer-facing certificates based on the requested hostname.
• Forgetting certificate name matching: The certificate must cover the alternate domain name requested by the client and, for custom HTTPS origins, the hostname CloudFront uses to connect to the origin.
• Selecting dedicated IPs by default: SNI is the normal, cost-efficient approach for modern clients; dedicated IP configuration is mainly for legacy compatibility.

Real-World Engineer Notes

• Treat the viewer and origin paths as separate security boundaries. Decide whether encryption is required on each segment rather than assuming one setting covers both.
• Redirecting HTTP to HTTPS improves compatibility, but clients still make an initial unencrypted request. Strict HTTPS-only behavior may be preferable for sensitive applications.
• Certificate renewal and deployment should be automated through ACM where possible. Imported or third-party certificates require a clear renewal and rotation process.
• When using an ALB as an origin, terminate TLS at the ALB or pass it onward according to the application design. Ensure the certificate and listener configuration match the CloudFront origin settings.
• Test older API clients, embedded devices, and non-browser integrations before relying on SNI exclusively.
• Keep CloudFront alternate domain names, DNS records, and certificate SANs synchronized. A mismatch in any one of these can cause deployment or TLS failures.

Quick Reference Summary

• CloudFront viewer certificate: ACM or public third-party certificate.
• ACM Region for CloudFront: us-east-1.
• Viewer protocol: Client to CloudFront.
• Origin protocol: CloudFront to origin.
• S3 HTTPS: Uses an AWS-managed S3 certificate.
• Custom HTTPS origin: Requires a publicly trusted certificate.
• SNI: Selects the correct certificate using the requested hostname and allows certificate sharing on one IP.
• Legacy non-SNI clients: May require dedicated-IP custom SSL support.

Flashcards

1. Q: In which Region must an ACM certificate for CloudFront be issued or imported?

A: us-east-1, or US East (N. Virginia).

1. Q: What does the viewer protocol policy control?

A: How CloudFront handles HTTP and HTTPS requests from clients.

1. Q: What does the origin protocol policy control?

A: Whether CloudFront uses HTTP or HTTPS when connecting to the origin.

1. Q: Does HTTPS from the viewer to CloudFront guarantee HTTPS to the origin?

A: No. The origin protocol is configured separately.

1. Q: Who manages the HTTPS certificate for an S3 origin?

A: AWS manages the S3 endpoint certificate.

1. Q: What kind of certificate should a custom HTTPS origin present to CloudFront?

A: A publicly trusted certificate.

1. Q: What problem does SNI solve?

A: It allows multiple HTTPS hostnames and certificates to share a CloudFront IP address.

1. Q: How does CloudFront choose the correct SNI certificate?

A: The client sends the requested hostname during the TLS handshake, allowing CloudFront to select the matching certificate.

1. Q: What is the purpose of redirecting HTTP to HTTPS?

A: It upgrades clients that start with HTTP to a secure HTTPS request.

1. Q: When might dedicated-IP custom SSL be considered?

A: When compatibility with very old clients that do not support SNI is required.

Practice Questions

Question 1

A company hosts an Application Load Balancer in eu-west-1 and uses CloudFront with the custom hostname app.example.com. An architect requests an ACM certificate in eu-west-1 and cannot attach it to the CloudFront distribution. What should the architect do?

A. Request the certificate in the same Region as the ALB only.
B. Request or import the CloudFront viewer certificate in us-east-1.
C. Use an ACM private certificate in eu-west-1.
D. Attach the ALB certificate directly to CloudFront.

Correct answer: B

CloudFront requires ACM certificates used for its viewer-facing HTTPS configuration to be in us-east-1. The ALB can have its own regional certificate separately.

Question 2

A security requirement states that users must access a CloudFront distribution using HTTPS. The application team wants HTTP users to be sent automatically to the secure URL instead of receiving an error. Which configuration meets the requirement?

A. Viewer protocol policy: HTTP and HTTPS
B. Viewer protocol policy: Redirect HTTP to HTTPS
C. Origin protocol policy: HTTPS only
D. Configure HTTPS only on the ALB listener

Correct answer: B

The viewer protocol policy controls client connections. Redirecting HTTP to HTTPS upgrades clients while preserving usability. The origin protocol policy and ALB listener do not control how clients connect to CloudFront.

Question 3

A CloudFront distribution accepts HTTPS from clients but connects to an EC2 web server over HTTP. The company requires encryption across the entire path. What change is necessary?

A. Enable SNI on the clients only.
B. Change the viewer protocol policy to HTTP and HTTPS.
C. Configure the origin protocol to HTTPS and install a publicly trusted certificate on the web server.
D. Move the EC2 instance to us-east-1.

Correct answer: C

Viewer and origin connections are independent. End-to-end encryption requires CloudFront to use HTTPS to the origin and the origin to present a valid public certificate.

Question 4

A company wants one CloudFront distribution to serve five custom domains with different certificates. Most clients are modern web browsers, and minimizing cost is important. Which approach is most appropriate?

A. Assign a dedicated IP address to every domain.
B. Use SNI with matching certificates for the alternate domain names.
C. Use a self-signed certificate for all domains.
D. Use one certificate that does not include the requested domain names.

Correct answer: B

SNI allows CloudFront to select the certificate based on the hostname sent by a modern client, avoiding a separate dedicated IP for each certificate. Certificates must still cover their respective domains.

Question 5

A custom CloudFront origin is configured for HTTPS and uses a certificate signed by the company’s internal private CA. Requests from CloudFront fail certificate validation. What is the most likely correction?

A. Replace the certificate with one issued by a publicly trusted certificate authority.
B. Place the private CA certificate in the CloudFront distribution’s ACM store.
C. Configure the viewer protocol to HTTP.
D. Use the S3-managed certificate for the EC2 origin.

Correct answer: A

CloudFront custom origins should present publicly trusted certificates for HTTPS origin connections. A private or self-signed certificate is not suitable for the standard CloudFront origin validation path.