49

I'm trying to set a CNAME on Cloudflare to point to an Amazon API Gateway endpoint. The CNAME is for use when referring to one of my subdomains. The gateway in turn points to the IP of a server on DigitalOcean. I am very new to Amazon web services and would appreciate if someone could give me an overview of the correct configuration for the DNS, Amazon Gateway and Cloudfront (which I think is needed to expose the gateway to DNS servers external to Amazon). Any help would be much appreciated.

UPDATE

I've been going at this for a while now and not making much progress. Does anyone have an idea if this is a viable approach or how else it might be done?

UPDATE2

I thought I needed to add the CNAME record to cloudFlare and just ended up in a redirect loop, observed by:

curl -L -i -v https://sub.mydomain.com/
6
  • Did you read and follow the steps for using a custom domain name with API gateway at docs.aws.amazon.com/apigateway/latest/developerguide/…? Apr 20, 2016 at 19:22
  • As far as I can tell that would require me to set up certificates on Amazon. My DNS is setup on cloudflare and so was hoping to keep it simple as it does the ssl for me. The cloudflare domain works when calling it directly, so it seems to be just the call from cloudflare to the cloudfront that's the issue. Apr 20, 2016 at 20:08
  • "My DNS is setup on Cloudflare" and "Cloudflare does SSL for me" are completely unrelated things. For Cloudflare to do SSL it must not only do your DNS but also actually proxy requests for you. You seem to be mixing up different concepts in this question, leaving it very unclear what you are asking. Please try to explain what you are trying to accomplish, rather than how you are trying to accomplish it -- using a custom hostname and a Cloudflare-provided SSL certificate in front of an API Gateway endpoint is what it sounds like you're trying to do. Apr 20, 2016 at 20:16
  • Sorry about the confusion. I'm not a networking person and I guess it shows! I've got Cloudfront set up so that when I query my API through the cloudfront domain it works. My DNS is set up on Cloudflare and conversion of http to https through a page rule. I'm trying to add a sub domain api.mydomain.com to Cloudflare with a CNAME record to the cloudfront domain but it doesn't work. Apr 20, 2016 at 20:23
  • Okay, but that's not going to get you any Cloudflare SSL. Can you mention the hostname in question? There's no obvious reason for a redirect loop, but then again there's also no obvious reason why you need CloudFront in the chain in order to do what you're trying to do... at least, not based on the available information, unless you're trying to use an SSL certificate from Amazon Certificate Manager, which is integrated with CloudFront (but has not been otherwise mentioned so far). Apr 20, 2016 at 20:43

4 Answers 4

53

NOTE: It seems this method doesn't work anymore as AWS now only accepts certificates from certain authorities. I haven't tested it myself, but the answer by Gunar looks promising.

There are several reasons why it doens't work to simply point Cloudflare at your API Gateway domain and call it a day:

  • API Gateway uses shared hosting so it uses the domain name to figure out what API to send requests to. It has no way of knowing that api.yourdomain.com belongs to your API.
  • API Gateway requires that you use https, but the certificate that it uses is only valid for the default domain.

There is a solution, however. Here are the steps that I followed when I recently set this up:

  1. Generate an origin certificate from the crypto tab of the Cloudflare dashboard.
  2. Import the certificate to AWS Certificate manager in the us-east-1 region, even if your API is located in a different region. If you are prompted for the certificate chain you can copy it from here.
  3. Add your custom domain in the API Gateway console and select the certificate you just added. Check the AWS support article for more information on how to do this.
  4. It usually takes about 45 minutes for the custom domain to finish initializing. Once it's done it will give you a new Cloudfront URL. Go ahead and make sure your API still works through this new URL.
  5. Go to the Cloudflare DNS tab and setup a CNAME record pointing to Cloudfront URL you just created.
  6. Switch to the crypto tab and set your SSL mode to "Full (Strict)". If you skip this step you'll get a redirect loop.

That's it. Enjoy your new highly available API served from your custom domain!

7
  • 3
    God damn! I probably spent over 10 hours trying to figure out why this wasn't working and all that is needed was the mystical step 6. You sir, deserve a reward.
    – Alix Axel
    Dec 7, 2017 at 22:32
  • What if I have other subdomains that aren't actually serving via HTTPs?! Full (strict) isn't going to break them?
    – enapupe
    Jul 17, 2018 at 21:22
  • Is the step to create a certificate necessary or can you just create a certificate in the AWS Certificate Manager?
    – mbrookson
    May 18, 2019 at 20:05
  • 1
    Something to add to this answer is that only 1024 or 2048 RSA origin certificates can be used - aws.amazon.com/premiumsupport/knowledge-center/… Jun 27, 2020 at 8:18
  • The step to create a certificate is a workaround if you can't create a certificate in the AWS Certificate Manager directly.
    – nponeccop
    Mar 12, 2021 at 18:10
26

Set up Amazon's API Gateway Custom Domain with CloudFlare

  1. In your AWS management console go to the API Gateway service and select Custom Domain Names from the left menu.

  2. Click the Create button.

  3. Log into CloudFlare, select your domain and open the Crypto tab

  4. Go to SSL and set your SSL mode to "Full (Strict)" to avoid a redirect loop.

  5. Go to Origin Certificates and click Create Certificate

  6. Let CloudFlare generate a private key and a CSR and choose RSA as the private key type

  7. Make sure that the hostname for your custom API domain is covered. (e.g. api.mydomain.com. You can specifically configure this custom domain or use a wildcard such as *.mydomain.com as is configured by default.

  8. Pick PEM as the key format which is selected by default.

  9. In AWS switch to region US-EAST-1 and goto the Certificate Manager.

  10. Click Import a Certificate.

  11. Copy the certificate body from your CloudFlare certificate to Certificate body to the configuration of the custom domain in the AWS Management Console.

  12. Copy the Private key to the certificate private key field in the console

  13. In the certificate chain copy the Cloudflare Origin CA - RSA Root which can be found here.

  14. Enter your custom domain name in the AWS console and a name for your certificate

  15. Now the custom domain name will be created in AWS CloudFront. It can take up to an hour before the domain becomes active.

  16. The next thing you need to do is set up the mappings of the custom domain in the AWS Console.

  17. The final step is to create a new CNAME Record in CloudFlare to link your domain to the CloudFront url. When you open the settings page of your custom domain in the AWS console copy the Distribution domain name. This is the domain you need to use when creating the new CNAME Record.

Source

4
  • 2
    I agree. Neutralized! ;-) Dec 13, 2017 at 12:59
  • 1
    Unfortunately my main website doesn't have SSL enabled (which is why I'm using CloudFlare to front-end the website). Therefore Full doesn't work... Apr 30, 2018 at 6:21
  • Can you elaborate step 15 and 16? I created custom domain but didn't get any cloudfront url Jul 23, 2020 at 8:24
  • @VinayPrabhu this may help provide some insight to CloudFront domains you are interested in.. docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/… Aug 14, 2020 at 3:33
5

I couldn't get any of the other answers to work. So I ended up having AWS generate the certificate instead of using a Cloudflare Origin one. That's because AWS wouldn't accept my Cloudflare certificate, even when the chain was provided. I couldn't see Cloudflare in Mozilla's Certificate Authority list (which is what AWS relies on, according to the docs) so I guess that makes sense.


Here's the outline of my solution:

  1. Create AWS Route53 Zone
  2. Create AWS ACM Certificate (must be in us-east-1) with validation method DNS
  3. Create Cloudflare DNS Record with the output of (2)
  4. Create AWS API Gateway Domain Name
  5. Create Cloudflare DNS CNAME Record pointing '@' (root domain) to the Cloudfront domain name from step (4)
  6. Create AWS API Gateway Base Path Mapping

This should be roughly it. May this help someone. Feel free to ask questions.

3
  • This was the solution I implemented. The CNAME record that was created in Cloudflare needs to have DNS only(not proxy), now when I enable Cloudflare rate-limiting rules in this, the rule never takes effect. Shedding any light on this will be appreciated. Jun 28, 2021 at 18:16
  • Cloudflare needs to be the proxy if it's to be able to apply rate limiting. Jun 29, 2021 at 11:24
  • 1
    Resolved it, changed the record to the proxy. Previously this didn't work as I missed the cert for the 3rd level subdomain for which the record was created. Jun 30, 2021 at 13:39
4

Both existing answers to this question are correct, but if the issue still persists even after following these directions perfectly, try going into the API Gateway settings, navigate to "Custom Domain Name" and configure the Base Path Mappings.

This was the missing step that solved all my problems.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.