title: AWS Load Balancer, enable listener for HTTPS and route to 80
body: <p>I've an AWS LoadBalancer in front of two servers running SailsJS with PM2. The LB works very well and routes the incoming HTTP requests to the server, which is perfect.</p>
  
  <p>Now, I need to add support for HTTPS, so I followed this guide:
  <a href="http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-create-https-ssl-load-balancer.html" rel="nofollow noreferrer">AWS Create a Classic Load Balancer with an HTTPS Listener</a>, using a self-generated SSL certificate, and used this configuration for the ports </p>
  
  <pre><code>LB Port 80 - Instance 80 
  LB Port 443 - Instance 80
  </code></pre>
  
  <p>And the security group has these ports opened:</p>
  
  <pre><code>22, 
  80, 
  443
  </code></pre>
  
  <p>So, if I understood correctly, the LB will receive the HTTPS request on port 443 and will forward it to port 80 of the instance. My instance, of course, is listening on port 80.</p>
  
  <p>The problem is, this don't work! I can make HTTP requests to the LB and all is routed perfectly to the Sails instance and the response is perfect. But if I use exactly the same URL but with HTTPS, then it doesn't work and I get a "ERR_SSL_PROTOCOL_ERROR".</p>
  
  <p>What am I doing wrong, what am I missing?</p>
  
  <p>Thank you! </p>
  
  <p><strong>EDIT 1</strong>
  This is what I get if I try curl -v <a href="https://example.com" rel="nofollow noreferrer">https://example.com</a></p>
  
  <pre><code>* Trying xx.xx.xx.xx...
  * Connected to example.com (xx.xx.xx.xx) port 443 (#0)
  * Unknown SSL protocol error in connection to example.com:-9838
  * Closing connection 0
  curl: (35) Unknown SSL protocol error in connection to mydomain.com:-9838
  </code></pre>
  
  <p><strong>EDIT 2</strong></p>
  
  <p>Found another thread <a href="https://stackoverflow.com/questions/34835859/node-js-https-example-error-unknown-ssl-protocol-error-in-connection-to-localh">which suggested a different way of creating the certificate</a>. So I tried it, but now AWS don't even accept the private key and the certificate</p>
  
  <pre><code>Server Certificate not found for the key:    arn:aws:iam::111111111:server-certificate/CertificateMyName
  </code></pre>
  
  <p><strong>EDIT 3</strong></p>
  
  <p>OK, so found more info on why I <a href="https://serverfault.com/questions/737636/cant-add-ssl-listener-server-certificate-not-found-for-the-key">couldn't load the certificates to AWS</a> and after trying some times, I managed to load it and use it.</p>
  
  <p>After these, it appears to be working (with the warnings that is not a valid cert and bla, bla, bla, which is expected)</p>
  
  <pre><code>* Trying XXX.XXX.XXX.XXX...
  * Connected to example.com (XXX.XXX.XXX.XXX) port 443 (#0)
  * SSL certificate problem: Invalid certificate chain
  * Closing connection 0
  curl: (60) SSL certificate problem: Invalid certificate chain
  </code></pre>
  
  <p>So it appears to be working, and it appears, as @MarkB suggested that the certificate was wrong. Using the info found on EDIT 2, I created a new one, and upload it (with the info of EDIT 3) and it appears to be working.</p>
  
  <p>I'll perform more tests to make 100% sure that this works and will report back soon.</p>