Server Load Balancer:Configure an ALB instance to use SM HTTPS for secure communication

1. Create an ECS instance and deploy a service

1. Create an ECS instance with the following configurations.

   • Instance Name: ECS01

   • Region: China (Shanghai)

   • VPC: VPC1

   • vSwitch: VSW1

   • Image: Alibaba Cloud Linux 3.2104 LTS 64-bit

2. Connect to the ECS01 instance. Run the following commands to deploy an Nginx service.

   sudo yum install -y nginx
   sudo systemctl start nginx
   echo "Hello from ECS backend" | sudo tee /usr/share/nginx/html/index.html

3. Add an inbound rule to the security group of the ECS instance to allow incoming traffic. Make sure the rule has a high priority.

   • Authorization Policy: Allow

   • Protocol: Custom TCP

   • Source: Select IPv4, and then select This VPC CIDR block.

   • Destination (This Instance): Select Port, and then select HTTP (80).

For more information, see Create an instance on the Custom Launch tab, Connect to an ECS instance, and Add security group rules.

2. Create an ALB instance

1. Log on to the ALB console, select the China (Shanghai) region, and then click Create ALB.

2. On the purchase page, complete the following configurations and click Buy Now.

   • Instance Network Type: Select Internet.

   • VPC: Select VPC1.

   • Zone: Select Shanghai Zone E and Shanghai Zone F. Then, select VSW1 and VSW2 respectively, and select Assign EIP.

   • IP Version: Select IPv4.

   • Edition (Instance Fee): Select Standard.

3. On the Confirm Order page, confirm the instance configuration details and click Activate Now.

3. Create a server group and add backend servers

1. In the Server Group console, confirm that China (Shanghai) is selected as the region, and then click Create Server Group.

2. Configure the server group based on the following information and click Create.

   • For Server Group Type, select Server Type.

   • Server Group Name: Enter sg-nginx.

   • VPC: Select VPC1.

   • Backend Server Protocol: Keep the default value HTTP.

3. In the The server group is created dialog box, click Add Backend Server. Select ECS01 and click Next. In the Ports/Weights step, set the Port of the server to 80 and click OK.

4. Create a TLS security policy that includes SM cipher suites

When you use an SM certificate, you must use a custom TLS security policy that includes SM cipher suites. Default system policies do not include SM cipher suites.

1. In the navigation pane on the left of the ALB console, click TLS Security Policy. On the Custom Policy tab, click Create Custom Policy.

2. In the panel that appears, set the policy Name to gm-tls-policy. Set Minimum Version to TLS 1.0 and Later. In the Cipher Suite section, move ECC-SM2-WITH-SM4-SM3 to the selected box on the right, and then click Create.

ECC-SM2-WITH-SM4-SM3 is an alias for ECC-SM2-SM4-CBC-SM3 and ECC-SM2-SM4-GCM-SM3.

5. Create an HTTPS listener and configure an SM certificate

1. In the ALB console, click the ID of the target instance to go to the Instance Details page. On the Listener tab, click Create Listener.

2. In the Configure Listener step, set Listener Protocol to HTTPS and set Listener Port to 443. Then, click Next.

3. In the Configure SSL Certificate step, select the prepared SM certificate. The certificate list displays the algorithm type. SM2 indicates an SM certificate. Set TLS Security Policy to gm-tls-policy, and then click Next.

4. In the Select Server Group step, select the sg-nginx server group, and then click Next.

5. In the Configuration Review step, confirm the configurations and click Submit.

After you configure an SM certificate, you must select a custom TLS security policy that includes SM cipher suites. Otherwise, clients cannot access the service.

6. Configure domain name resolution

Point your custom domain name to the DNS name of the ALB instance by adding a CNAME record. This allows clients to access the ALB instance through your custom domain name.

This topic uses Alibaba Cloud DNS as an example. If your domain name is not registered with Alibaba Cloud, you must first add the domain name to the Alibaba Cloud DNS console.

1. In the ALB console, copy the Domain Name of the target instance.

2. Log on to the Alibaba Cloud DNS console. In the Actions column of the target domain name, click Settings. On the Settings page, click Add Record.

3. Add a CNAME record with the following information and click OK.

   • Record Type: Select CNAME.

   • Hostname: Enter a domain name prefix, such as sm2. If your custom domain name is example.com, the domain name to access the ALB instance is sm2.example.com.

   • Query Source and TTL: Keep the default values.

   • Record Value: Enter the DNS name of the ALB instance.

4. In the Change Resource Record Confirmation dialog box that appears, confirm the DNS record information and click OK.

7. Test and verify

• sm2.example.com is an example domain name. When you perform the test, replace it with the actual domain name configured in Step 6. Make sure the DNS record has taken effect.

• To access a website that uses an SM certificate, you need a browser that supports SM algorithms. This topic uses the ZOS browser as an example.

Limits

• Only upgraded ALB instances support SM certificates. This feature is not supported on ALB instances created before the upgrade. You can use ALB instance cloning to manually migrate services from an existing ALB instance to an upgraded ALB instance.

• Only Standard and WAF-enabled ALB instances support SM certificates. The Basic and Advanced editions do not support SM certificates.

• SM certificates do not support mutual authentication. CA certificates do not support the SM2 type.

Billing

• ALB instance: ALB supports pay-as-you-go and subscription billing methods. For more information, see Billing overview of ALB.

• ECS instance: For more information, see Billing overview of ECS. If you create an ECS instance for testing purposes, create a low-specification pay-as-you-go instance and release it after the test to avoid unnecessary charges.

• Domain name and DNS resolution fees: In addition to the domain name fee charged by your domain name provider, you must pay for public authoritative DNS resolution when you configure DNS resolution on Alibaba Cloud.

FAQ

References

• Manage certificates: Learn about the certificate types supported by ALB and the certificate matching logic.

• Add an HTTPS listener: Learn about all the configuration parameters for an HTTPS listener.

• TLS security policies: Learn about default system policies and custom policies.