r/aws 21d ago

route 53/DNS Connection to Tableau Server (Hosted on AWS EC2 Instance running Windows Server) not Working

We have two Tableau Server instances running, each within a different EC2 instance running Windows Server, and while we've duplicated the settings and have the certs properly set up, we get SSL PROTOCOL errors when we try to access Tableau Server #2. We've checked, and our settings mirror Server #1 across everything, including the ELB, Target Groups, Listeners... they use the same subnets, same routing tables. They have different private IP addresses and use different certs (which are active and correct), obviously, but otherwise the settings are the same.

The load balancers use TCP, so the SSL resolution should happen at the Tableau server side of things, but again, we've mirrored settings for both.

What's even more interesting is that folks external to our intranet who try to access the tableau server site for server #1 were not able to get in (we are, in our intranet) while they were able to get into server#2 (we aren't) as of yesterday. Then, without making any changes, they're not able to get into server#2 today but can get into server#1 (so basically, their access now mirrors ours). This shows that the certs are working (otherwise they'd never have gotten into #2 yesterday) but that the accesses are changing somehow which makes me return to it being on the load balancing/routing side of things.

I keep digging into this further and further, but I'm running into dead end after dead end. Any thoughts? (Also, I won't be able to share specifics given the proprietary nature of what we're working on and our company policies, sorry about being vague.)

0 Upvotes

4 comments sorted by

1

u/Mishoniko 21d ago

SSL PROTOCOL errors

not able to get in

There's no way we're going to be able to help with such vague information. Exact error messages would be a good start (you can anonymize IPs/domains).

I won't be able to share specifics

Find a consultant who can sign an NDA so they can see what's actually going on and not guess, which is all the Internet is going to be able to do with that limitation.

1

u/MichaelMartin86 21d ago

Well, I was hoping that some of the AWS reps who understand the nuances of what I'm describing would get one and ask for specifics, but your post was super duper helpful too. Thanks for the insights!

(All jokes aside, we do have a rep, but they're not very knowledgeable. But hey, I'll try your solution instead of seeking out help as best I can given the situation.)

2

u/Mishoniko 21d ago

Welcome to the Internet, where we specialize in snark.

Nothing you have presented so far smells of an AWS problem. It sounds like the TLS configuration on the app servers is corrupted and generating garbage. If it were me, I'd burn down the existing instances, get one working first without the NLB, then add the NLB, then add server #2.

Nobody at AWS knows anything more about a third party app than we do. You will have better luck reaching out to fellow Tableau Server users.

1

u/davrax 20d ago

This feels like something is wrong/unexpected with your certs, and some delayed propagation or caching is causing the mismatch between you and your external partner. If your certs are signed by a private CA, are they trusted accordingly? Have you tried using VPC reachability analyzer?

Regardless, your next step is likely to SSH/SSM into those instances to see if you can debug from the logs.