This topic describes how to enable an HTTPS listener of an Application Load Balancer (ALB) instance to forward HTTPS requests destined for different domain names to different backend servers.
Sample scenario
This topic describes how to configure multiple certificates for an HTTPS listener of a Classic Load Balancer (CLB) instance to forward HTTPS requests to different backend servers based on forwarding rules.
The following configurations are used in this example:
The default certificate of the listener is associated with the domain name
aliyundoc.com. The default backend server group is RS1.The additional certificate example1 of the listener is associated with the domain name
www.example.com. Requests that are destined forhttps://www.example.comare forwarded to the backend server group RS1.The additional certificate example2 of the listener is associated with the domain name
www.example.org. Requests that are destined forhttps://www.example.orare forwarded to the backend server RS2.
Prerequisites
A CLB instance is created. For more information, see Create and manage a CLB instance.
A vServer group named RS1 and another vServer group named RS2 are created. For more information, see Create and manage vServer groups.
ECS01 is added to RS1 and ECS02 is added to RS2. Applications are deployed on ECS01 and ECS02.
The domain name is registered and an Internet content provider (ICP) number is obtained for the domain name. For more information, see Register a domain name on Alibaba Cloud and ICP filing application overview.
Required certificates are deployed. If the certificates are purchased from a third-party service provider, you must upload them to Certificate Management Service. In addition, make sure that the certificates are associated with your domain name. For more information about how to apply for a certificate, see Submit a certificate application. The following certificates are used in this example:
The default certificate that is associated with the domain name
aliyundoc.com.The additional certificate example1 that is associated with the domain name
www.example.com.The additional certificate example2 that is associated with the domain name
www.example.org.
NoteDeploy the certificates on the CLB instance. Otherwise, the certificates cannot take effect. For more information, see Create a certificate.
Step 1: Create an HTTPS listener
Log on to the CLB console.
In the top navigation bar, select the region in which the CLB instance in created.
On the Instances page, find the CLB instance that you want to manage, and click Configure Listener in the Actions column.
In the Protocol & Listener step, set the parameters and click Next.
The following section describes some of the parameters. Set the other parameters based on your business requirements.
Select Listener Protocol: HTTPS is selected in this example.
Listener Port: Port 443 is selected in this example.
In the Certificate Management Service step, select a certificate that you uploaded and click Next. The default certificate is selected in this example.
In the Backend Servers step, select vServer group and select RS1 from the Server Group drop-down list.
Keep the default values for other parameters and click Next. In the Confirm step, click Submit.
Step 2: Add additional certificates
On the Instances page, click the ID of the CLB instance that you want to manage.
On the Listeners tab, find the HTTPS listener that you want to manage and choose
> Manage Additional Certificate in the Actions column. In the Manage Additional Certificate panel, click Add Additional Certificate to add an additional certificate.
Set Additional Certificate to
www.example.com, select the certificate that is associated withwww.example.comfrom the Server Certificate drop-down list, and then click OK.Set Additional Certificate to
www.example.org, select the certificate that is associated withwww.example.orgfrom the Server Certificate drop-down list, and then click OK.
NoteThe domain names of the certificates must be the same as those of the additional certificates.
Step 3: Add forwarding rules
On the Instances page, click the ID of the CLB instance that you want to manage.
On the Listeners tab, find the listener that you want to manage and click Set Forwarding Rule in the Actions column.
In the Add Forwarding Rules panel, set the parameters to create a forwarding rule.
In this example, a domain name-based forwarding rule is created. No URL-based forward rule is created.
Set Domain Name to
www.example.com, select a vServer group, and then click Add Forwarding Policy.Set Domain Name to
www.example.org, select a vServer group, and then click Add Forwarding Policy.
After you create the forwarding rules, close the Add Forwarding Rules panel.
Step 4: Configure domain name resolution
Add an A record for each of www.example.com and www.example.org to map them to the public IP address of the CLB instance.
Log on to the CLB console.
In the top navigation bar, select the region in which the CLB instance is deployed.
Find the CLB that you want to manage and copy the IP address.
Perform the following steps to add an A record:
Log on to the Alibaba Cloud DNS console.
On the Domain Name Resolution page, click Add Domain Name.
In the Add Domain Name dialog box, enter the domain name of your host and click OK.
ImportantBefore you create the A record, you must use a TXT record to verify the ownership of the domain name.
Find the domain names that you want to manage and click Configure in the Actions column.
On the DNS Settings page, click Add Record.
In the Add DNS Record panel, configure the following parameters and click OK.
Parameter
Description
Type
Select A from the drop-down list.
Host
Enter the prefix of your domain name.
DNS Request Source
Select Default.
Record Value
Enter the IP address of the CLB instance.
TTL
Select a time-to-live (TTL) value for the CNAME record to be cached on the DNS server. The default value is used in this example.
Step 5: Verify the result
Access www.example.com and www.example.org from a browser to test whether you can access ALB. In this example, a static webpage is created on each of the backend servers in RS1 and RS2.
Access the domain name
www.example.com, which is associated with the additional certificate example1, from a browser. The request is forwarded to ECS01 on the backend server in RS1 based on the forwarding rule. The following figure shows the test result.
Access the domain name
www.example.org, which is associated with the additional certificate example2, from a browser. The request is forwarded to ECS02 on the backend server in RS2 based on the forwarding rule. The following figure shows the test result.
If you cannot access the domain names, restart your browser to clear the cache and try again.
References
For more information about how to forward requests destined for different URLs of the same domain name to different backend server groups, see Forward requests destined for the same domain name but different URLs.
For more information about domain name-based forwarding rules and URL-based forwarding rules, see Forward requests based on domain names or URLs.