SSL for Mapped Domains with Wordpress Multisite on AWS

Question

I've setup Wordpress Multisite on an Amazon Web Server EC2 instance. I'm using an Elastic IP and a Load Balancer on the instance. I have setup a wildcard SSL certificate for the Multisite through AWS Certificate Manager, which works for the main site and all new subdomain websites created. I applied this certificate to the load balancer.

Now I am trying to setup an SSL certificate for a mapped domain. I have the domain bought through Namecheap and have setup an A Record to the Elastic IP. I also created an AWS Certificate and validated it through a CNAME record on the Namecheap DNS. I applied this certificate to the same Load Balancer and I setup a Route 53 for the subdomain in AWS that I pointed to the Load Balancer.

The domain mapping works as I have gotten newsite.com to show the content on newsite.multisite.com without showing the subdomain URL. However, the SSL certificate defaulted to the Bitnami default SSL which is obviously unsecure:

I am using the Really Simple SSL plugin to activate the SSL certificate on my websites. Any ideas on how to get this working?

Answer 1

If I'm reading this right, you have

• multisite.com set up with an Elastic Load Balancer using Route 53 and a wildcard certificate that also includes newsite.com
• newsite.com set up as an A record directly to your origin server not ELB

In which case you're most of the way to routing all newsite.com traffic through ELB which I think is going to be the best option:

• set up newsite.com on Route 53 too - I think you have to do this so that you can ALIAS the newsite.com (without the www) to your Elastic Load Balancer, since you're not allowed to CNAME a root domain and you can only ALIAS from inside Route 53
• in your Namecheap DNS console, configure Route 53 as the authoritative DNS servers for newsite.com

It's not possible to take the AWS SSL certificate and install it on your origin server: Amazon doesn't give you access to the raw certificates, just serves them for you on ELB and CloudFront.

Or alternatively you could generate a letsencrypt.org certificate for newsite.com for your origin server, which will need renewing every few months but you can set that up automatically. This should be safe since your elastic IP for your origin server isn't going to change so you can A newsite.com to it as you already have. And would save you the (small) cost of Route 53 for newsite.com. Both method will scale to new domain names too.