Global Accelerator:Use a single GA instance to accelerate multiple domain names over HTTPS

Scenario

The following table describes the information about the web servers of the company and the forwarding rules that are used by the HTTPS listener after the company uses the GA service to accelerate its web application.

Prerequisites

• An SSL certificate is purchased and an application is submitted to apply for the SSL certificate. For more information, see Purchase an SSL certificate and Submit a certificate application.

• The certificate is uploaded to the backend servers. For more information, see Upload files to ECS instances.

• An HTTP service that uses port 80 is deployed on Server 1 and an HTTPS service that uses port 443 is deployed on Server 2 by using NGNIX.

• The A records that map backend domain name 1 (xxx test.cloud) and backend domain name 2 (www.xxx test.cloud) to the public IP addresses of the backend servers are created.

Procedure

Step 1: Configure the basic information about an instance

1. Log on to the GA console.

2. On the Instances page, click Create GA Instance. Select Subscription Standard Instance or Pay-as-you-go Standard Instance based on your business requirements.

   In this example, Pay-as-you-go Standard Instance is selected.

3. In the Basic Instance Configuration step, configure the following parameters and click Next.

   Parameter	Description
   GA Instance Name	Enter a name for the GA instance.
   Instance Billing Method	Pay-As-You-Go is selected by default. You are charged instance fees, Capacity Unit (CU) fees, and data transfer fees for pay-as-you-go standard GA instances. For more information about instance fees and CU fees, see Billing of pay-as-you-go GA instances. For more information about data transfer fees, see Pay-by-data-transfer.
   Resource Group	Select the resource group to which the standard GA instance belongs. The resource group must be a resource group created in Resource Management by the current Alibaba Cloud account. For more information, see Create a resource group.

Step 2: Add an acceleration area

By adding an acceleration area, you can specify the regions of the GA users and allocate bandwidth to the regions.

In the Configure acceleration areas step, configure the parameters and click Next. The following table describes the parameters.

Step 3: Configure a listener

A listener listens for connection requests and distributes the requests to endpoints based on the port and the protocol that you specify. Each listener is associated with an endpoint group. You can associate an endpoint group with a listener by specifying the region to which you want to distribute network traffic. After you associate an endpoint group with a listener, network traffic is distributed to the optimal endpoint in the endpoint group.

In the Configure listener step, configure the following parameters and click Next.

Step 4: Configure an endpoint group and endpoints

1. In the Configure an endpoint group step, configure the endpoint group and the endpoints, and then click Next.

   This topic describes only the key parameters. For more information, see Add and manage endpoint groups of intelligent routing listeners.

   Parameter	Description
   Region	Select the region where you want to deploy the endpoint group. In this example, US (Silicon Valley) is selected.
   Endpoint Configuration	Client requests are routed to endpoints. To add an endpoint, set the following parameters: Backend Service Type: Select Alibaba Cloud Public IP Address. Backend Service: Enter the IP address of the backend service that you want to accelerate. In this example, 47.XX.XX.62 is entered, which is the public IP address of Server 1. Weight: Enter a weight for the endpoint. Valid values: 0 to 255. GA routes network traffic to endpoints based on the weights of the endpoints. In this example, the default value 255 is used. Warning If you set the weight of an endpoint to 0, Global Accelerator stops distributing network traffic to the endpoint. Proceed with caution.
   Preserve Client IP	By default, client IP address preservation is enabled. This feature allows you to view client IP addresses on backend servers. HTTP listeners can retrieve client IP addresses from the X-Forwarded-For HTTP header. For more information, see Preserve client IP addresses.
   Backend Service Protocol	Select the protocol that is used by backend servers. In this example, the default value HTTP is used.
   Port Mapping	If the listener port is not the same port over which the endpoint provides services, you must set this parameter. Listener Port Enter the port of the current listener. In this example, the value is set to 443. Endpoint Port Enter the port over which the endpoint provides services. In this example, 80 is used.
   Traffic Distribution Ratio	Specify a traffic distribution ratio for the endpoint group. Valid values: 0 to 100. In this example, the default value 100 is used.
   Health Check	Specify whether to enable the health check feature. After you enable this feature, you can use health checks to check the status of endpoints. For more information about the health check feature, see Enable and manage health checks. In this example, the health check feature is disabled.

2. In the Configuration Review step, check the configurations and click Submit.

   Note

   It takes 3 to 5 minutes to create a GA instance.

3. (Optional) After you create a GA instance, you can click the instance ID on the Instances page to view the configurations of the instance. On the instance details page, you can click tabs such as Instance Information, Listeners, and Acceleration Areas to view more details.

4. Configure a virtual endpoint group.

   1. On the instance details page, click the Listeners tab.

   2. On the Listeners tab, find the listener that you want to manage and click the endpoint group ID in the Default Endpoint Group column.

   3. On the Endpoint Group tab, click Add Virtual Endpoint Group in the Virtual Endpoint Group section.

   4. On the Add Endpoint Group page, configure the parameters based on the following information and click Create.

      The configurations of the virtual endpoint group are the same as those of the default endpoint group that you created in Step 4-1, except for the following parameters.

      • Backend Service Type: Select Alibaba Cloud Public IP Address.

      • Backend Service: Enter 47.XX.XX.34, which is the public IP address of Server 2.

      • Backend Service Protocol: Select HTTPS.

      • Port Mapping: You do not need to add a port mapping.

        If the listener port is the same as the port over which the endpoint provides services, you do not need to add a port mapping. GA automatically forwards client requests to the listener port of the endpoint.

Step 5: Associate an additional certificate

You can associate multiple domain names with an HTTPS listener by associating an additional certificate with the listener. Based on the additional certificate and forwarding rules, GA can distribute requests that are destined for different domain names to different virtual endpoint groups.

You can perform the following operations to associate Certificate B with an HTTPS listener to associate domain name 2 (xxx test.fun) with the HTTPS listener.

1. On the Listeners tab, find the HTTPS listener with which you want to associate additional SSL certificates and click the listener ID.

2. On the listener details page, click the Certificates tab.

3. On the Certificates tab, click Associate Certificate in the Additional Certificate section.

4. In the Associate Certificate dialog box, configure the additional certificate and click OK.

   • Certificate: Select the certificate that you want to associate. In this example, Certificate B is used.

   • Associated Domain Name: Select one or more domain names that you want to accelerate by using GA. The certificate will be associated with the selected domain names. In this example, xxx test.fun is selected, which is domain name 2.

Step 6: Add a forwarding rule

When an HTTPS listener receives requests, it forwards requests that meet the conditions in forwarding rules to the associated endpoint groups. If the requests do not match any custom forwarding rule, the HTTPS listener forwards the requests to the default endpoint group in the default forwarding rule.

You can perform the following operations to add a custom forwarding rule for the virtual endpoint group that is associated with Server 2. This way, the requests that are destined for xxxtest.fun can be forwarded to Server 2.

1. On the Listeners tab, find the HTTPS listener with which you want to associate additional SSL certificates and click the listener ID.

2. On the listener details page, click Forwarding Rule.

3. On the Forwarding Rule tab, click Add Forwarding Rule.

4. In the Add Forwarding Rule section, configure the parameters and click OK. The following table describes the parameters.OK

   Parameter	Description
   Name	Enter a name for the forwarding rule.
   If (Matching All Conditions)	Select a match condition for the forwarding rule. In this example, Domain is selected and the xxxtest.fun domain name is entered.
   Then	Select a forwarding action. In this example, Forward to is selected and the virtual endpoint group that you created in Step 4: Configure an endpoint group and endpoints is selected.

Step 7: Add a CNAME record

1. Log on to the Alibaba Cloud DNS console.

2. If your domain name is not registered by using Alibaba Cloud Domains, you must add your domain name to Alibaba Cloud DNS.

   Note

   If your domain name is not registered by using Alibaba Cloud Domains, you must add your domain name to Alibaba Cloud DNS before you can configure a DNS record. For more information, see the "Add a domain name" section of the Manage domain names topic. If your domain name is registered by using Alibaba Cloud Domains, skip this step.

3. On the Domain Name Resolution page, find domain name 1 (xxxtest.cloud) and click DNS Settings in the Actions column.

4. On the DNS Settings page, find the A record and click Modify in the Actions column.

5. In the Modify DNS Record panel, set Record Type to CNAME, set Record Value to the CNAME assigned to the GA instance, and then click OK.

   You can view the CNAME assigned to the GA instance on the Instances page.

6. Repeat Step 3 to Step 5 to modify the A record of domain name 2 (xxxtest.fun) and add a CNAME record for the domain name.

Step 7: Test network connectivity

1. Open the CLI on an on-premises machine in the China (Hong Kong) region.

2. Run the following command to ping domain name 1 (xxx test.cloud) and domain name 2 (xxx test.fun) to check whether the CNAME records take effect:

   ping <Website domain name>

   If the CNAME in the output is the same as the CNAME assigned by GA, the CNAME record takes effect.

   

3. Run the following command for domain name 1 (xxx test.cloud) and domain name 2 (www. xxx test.cloud) to test the network connectivity:

   curl -v https://<The domain name> --resolve <The domain name>:<The listener port>:<The accelerated IP address>

   In this example, the test result of domain name 1 (xxx test.cloud) is used. If the response contains the server certificate information and HTTPS response information, the domain name is accessible.

   

4. For information about how to verify the acceleration performance, see Perform instant detection to test the acceleration performance of GA.