Article Type: Solution

The AWS Certificate Manager (ACM) automatically manages and renews the certificate, which all current browsers will accept without any security exceptions.

The downside is that you need control over your Hosted DNS name entry through Route 53 or another provider.

Prerequisites

    * MarkLogic AWS Cluster

    * An AWS Route 53-hosted Domain or similar externally hosted Domain; the procedure described in this article assumes that Route 53 is being used; however, where possible, we have tried to detail the changes needed, which should also apply to another external DNS provider.

1. Click on your hostname in Route 53 to edit it.

2. Create a new Alias Record Set to point to your Elastic Load Balancer.



3. In the Record Set entry on the right-hand side, enter an Alias name for your ELB host, select Alias and from the Alias Target, select the ELB load balancer to use, then click the Create button to update the Route 53 entry.



4. It can take a little while for AWS to propagate the DNS update throughout the network, but once it is available, it is worth checking that you can reach your MarkLogic cluster using the new address, e.g.



5. Once the Route 53 entry is updated and available, you must request a new certificate through ACM; if you have other certificates already in ACM, you can select Request a certificate.


Otherwise, select Get Started with Provision Certificates and Request a Public Certificate.


6. Enter your required Certificate domain name and click Next:

Note: This should match your DNS Alias name entry from  Step 3.

In addition you can also add additional records such as a "Wildcard" entry, this is particularly useful if you want to use the same certificate for multiple hostnames, e.g if you have Clusters identified by versions such as ml9.[yourdomain].com & ml10.[yourdomain].com

7. Select DNS as the Validation Method and click "Review"



8. Before you confirm and proceed, please check that the host names are correct, as certificates with invalid host names will not be used.



9. To complete validation, AWS will require you to add random CNAME entries to the DNS record to confirm that you are the owner. If you are using Route 53, this is as simple as selecting each entry in turn; the number will vary depending on the number of Domain name entries you specified in step 6 and clicking "Create a record in Route 53."

Once all entries have been created, click Continue.


10. A success message will be displayed if the update is successful.


11. If an external provider provides your DNS Hostname, you must download the entries using the "Export DNS configuration to a file link" and give this information to your DNS provider to make the necessary updates.

The file is a simple CSV file that specifies one or more CNAME entries that need to be created with the required name and values. Once the AWS DNS validation process detects these changes, the certificate creation process will be completed automatically.

Domain Name,Record Name,Record Type,Record Value

marklogic.[yourdomain].com,_c3949adef7f9a61dd6865a13e65acfdb.marklogic.[yourdomain].com.,CNAME,_7ec4e5ce2cf31212e20ce68d9d0ab9fd.kirrbxfjtw.acm-validations.aws.

*.[yourdomain].com,_9b2138934ee9bbe8562af4c66591d2de.[yourdomain].com.,CNAME,_924153c45d53922d31f7d254a216aed0.kirrbxfjtw.acm-validations.aws.

12. Once the Certificate has been validated by either of the methods in Steps 9 or 11, the certificate will be marked as Issued and available for the Load Balancer to use.



13. Configure the ELB for HTTPS And the new AWS-generated Certificate

14. Edit the ELB Listeners and change the Cipher



15. (Optional) For production environments, it is recommended to allow TLSv1.2 only



16. Select the Certificate and repeat Steps 15 and 16 for each listener you want to secure.

17. Save the Listeners updates and ensure the update was successful.



18.  You should now be able to access your MarkLogic cluster securely over HTTPS using the AWS-generated certificate.