0

AWS console(EC2 dashboard) shows public DNS name as ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com for an EC2 instance.

But the same AWS EC2 has a different DNS name (shown below):

$ hostname -f ip-172-xx-xx-xx.ca-central-1.compute.internal

compared to DNS name shown at AWS console.

EC2 is created in default VPC.

AWS documentation says... When you launch an instance, we allocate a primary private IPv4 address for the instance. Each instance is also given an internal DNS hostname that resolves to the primary private IPv4 address; for example, ip-10-251-50-12.ec2.internal. You can use the internal DNS hostname for communication between instances in the same VPC, but we can't resolve the internal DNS hostname outside of the VPC.

Each instance that receives a public IP address is also given an external DNS hostname; for example, ec2-203-0-113-25.compute-1.amazonaws.com. We resolve an external DNS hostname to the public IP address of the instance from outside its VPC, and to the private IPv4 address of the instance from inside its VPC. The public IP address is mapped to the primary private IP address through network address translation (NAT)

We need to submit CSR to create server certificate for docker daemon running on AWS EC2.

Not sure which one dns name to prefer, hostname -f or public dns name given in AWS console? 

{ "CN": "somehostname.somepublicdns.com", "hosts": [ "somehostname.somepublicdns.com", "99.xx.xx.xx" ] }

hostname -f has different domain compared to DNS name shown in AWS console.

1) Which DNS name should be assigned to CN attribute? ip-172-xx-xx-xx.ca-central-1.compute.internal or ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com

2) If CN is ip-172-xx-xx-xx.ca-central-1.compute.internal then , does remote docker client connect with docker daemon after setting export DOCKER_HOST=tcp://ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com DOCKER_TLS_VERIFY=1?

Improve this question

1 Answer 1

Reset to default
3

First of all, you should not be using the CN attribute of certificates, but the SubjectAlternativeName attribute (also known as SAN). In fact, the fallback to CN if there's no SAN has been deprecated for some time now in browsers.

Still, your question stands of which hostname to use in the SAN of your certificates. The main question here is which name will you be using to connect to the service, since you should be using the same name in the certificate (and your client should be validating it!).

  • If you are accessing it as ip-172-xx-xx-xx.ca-central-1.compute.internal, place ip-172-xx-xx-xx.ca-central-1.compute.internal

  • If you are accessing it as ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com, use ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com

  • And if you are accessing it under either of those names, include both in the certificate. The SAN may contain many entries (they are usually capped by the CA, but dozens are easily supported everywhere).

Note that if you are only using the ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com name you may use a publicly trusted CA, whereas if there's any .internal entry, you can't do that, and would need to use your own CA and install that one on the clients.

Improve this answer
4
  • From outside VPC, docker client access docker daemon(running on EC2)as export DOCKER_HOST=tcp://ec2-99-xx-xx-xx.ca-central-1.compute.amazonaws.com DOCKER_TLS_VERIFY=1. From inside VPC, docker client access docker daemon as export DOCKER_HOST=tcp://ip-172-xx-xx-xx.ca-central-1.compute.internal DOCKER_TLS_VERIFY=1. So, what should the value of CN be? Commented Sep 17, 2019 at 21:26
  • am creating my own self signed CA Commented Sep 17, 2019 at 21:32
  • Then as you will be accessing with both names, you should follow point three: include both names in the certificate. You don't need even to provide a CN name, it should be ignored once you have a SubjectAlternativeName attribute on the certificate. Commented Sep 17, 2019 at 21:35
  • Am including both names in hosts attribute of json. Does that hold good? Commented Sep 17, 2019 at 21:40

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.