Configuring AWS ELB

Use the steps in this topic to configure AWS Elastic Load Balancer as the load balancer for WSO2 products.

Clustering deployment pattern

This cluster consist of three WSO2 Application Server instances running in separate EC2 instances as two worker nodes and one manager node. AWS ELB performs load balancing with this cluster by distributing incoming requests to the worker nodes via HTTP/S on port 80/443. In order to access the management console via load balancer we need a separate AWS ELB to make the request as https://mgt.as.wso2.com/carbon.

Configuring AWS ELB

1. Sign in to the AWS Management Console. 
2. On the Amazon EC2 Resources console, click on Load Balancers under the Network & Security section.
   
3. Click Create Load Balancer. In the page that appears, do the following.
   
   1. Specify Load Balancer Name and Create LB inside.
   2. Specify HTTP and HTTPS ports (here we have specify HTTP load balancer port 80 with Instance port 9763 and HTTPS load balancer port 443 with Instance port 9443).
   3. Click Continue.
4. In the Select Certificate section, provide the SSL certificates to configure the HTTPS listeners of the load balancer.
   

   1. Choose to use an existing SSL Certificate. 

   2. Click Continue.

5. In the Select a Cipher section, you must provide the security policies to configure the SSL negotiation settings of the load balancer.
   

   1. Select Predefined Security Policy or create a Custom Security Policy.

   2. Click Continue.

6. In the Configure Health Check section, the load balancer automatically perform health checks on EC2 instances and only routes to instances that pass the health check.
   

   1. Specify the Ping Protocol, and Ping Port as shown in the image above.

   2. Click Continue.

7. In the Add EC2 Instances section, set up worker nodes to the load balancer and click Continue.
   

8. In the Review section, you can review the configuration you made.
   
9. Finally click Create and a message appears indicating that you have successfully created the load balancer. Now you can see the ELB configuration in the dashboard.
10. In order to configure the AWS ELB to access the AS management console, follow the same steps above: There we need to setup HTTPS (443 -> 9444) port only and need to add EC2 instance which has manager node configurations.

Uploading a new SSL certificate

Extract the "Private Key" and "Public Key Certificate" from wso2carbon.jks. Type the password "wso2carbon" each time you are prompted.

1. Extract PK in PKCS12 format.
   keytool -v -importkeystore -srckeystore wso2carbon.jks -srcalias wso2carbon -destkeystore mypkcs12file.p12 -deststoretype PKCS12
2. Print the key.
   openssl pkcs12 -in mypkcs12file.p12 -nocerts -nodes
3. Copy only the key ("Begin Private Key" to "End Private Key") to a separate file (private.pem).
4. Remove the password from the extracted key. Note that server.key is the private key here.
   openssl rsa -in private.pem -out server.key
5. Extract the public key. Note that public.cert is the public key.
   keytool -export -alias wso2carbon -keystore wso2carbon.jks -rfc -file public.cert

Now copy and paste private/public keys in the AWS management console. Note that you have to copy including "-----BEGIN RSA PRIVATE KEY-----" and "-----END RSA PRIVATE KEY-----".

Give a meaningful name to the certificate.

Additional configurations

This includes any additional configurations that are specific to the WSO2 product you are configuring.

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
                   port="9443"
                   proxyPort="443"
                   bindOnInit="false"
                   sslProtocol="TLS"
                   sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"
                   maxHttpHeaderSize="8192"
                   acceptorThreadCount="2"
                   maxThreads="250"
                   minSpareThreads="50"
                   disableUploadTimeout="false"
                   enableLookups="false"
                   connectionUploadTimeout="120000"
                   maxKeepAliveRequests="200"
                   acceptCount="200"
                   server="WSO2 Carbon Server"
                   clientAuth="false"
                   compression="on"
                   scheme="https"
                   ciphers="SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA,SSL_DHE_RSA_WITH_DES_CBC_SHA,
         SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
         TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA"
                   secure="true"
                   SSLEnabled="true"
                   compressionMinSize="2048"
                   noCompressionUserAgents="gozilla, traviata"
                   compressableMimeType="text/html,text/javascript,application/x-javascript,application/javascript,application/xml,text/css,application/xslt+xml,text/xsl,image/gif,image/jpg,image/jpeg"
                                           keystoreFile="${carbon.home}/repository/resources/security/wso2carbon.jks"
                                           keystorePass="wso2carbon"
                   URIEncoding="UTF-8"/>