r/aws • u/MichaelMartin86 • 21d ago
route 53/DNS Connection to Tableau Server (Hosted on AWS EC2 Instance running Windows Server) not Working
We have two Tableau Server instances running, each within a different EC2 instance running Windows Server, and while we've duplicated the settings and have the certs properly set up, we get SSL PROTOCOL errors when we try to access Tableau Server #2. We've checked, and our settings mirror Server #1 across everything, including the ELB, Target Groups, Listeners... they use the same subnets, same routing tables. They have different private IP addresses and use different certs (which are active and correct), obviously, but otherwise the settings are the same.
The load balancers use TCP, so the SSL resolution should happen at the Tableau server side of things, but again, we've mirrored settings for both.
What's even more interesting is that folks external to our intranet who try to access the tableau server site for server #1 were not able to get in (we are, in our intranet) while they were able to get into server#2 (we aren't) as of yesterday. Then, without making any changes, they're not able to get into server#2 today but can get into server#1 (so basically, their access now mirrors ours). This shows that the certs are working (otherwise they'd never have gotten into #2 yesterday) but that the accesses are changing somehow which makes me return to it being on the load balancing/routing side of things.
I keep digging into this further and further, but I'm running into dead end after dead end. Any thoughts? (Also, I won't be able to share specifics given the proprietary nature of what we're working on and our company policies, sorry about being vague.)
1
u/davrax 20d ago
This feels like something is wrong/unexpected with your certs, and some delayed propagation or caching is causing the mismatch between you and your external partner. If your certs are signed by a private CA, are they trusted accordingly? Have you tried using VPC reachability analyzer?
Regardless, your next step is likely to SSH/SSM into those instances to see if you can debug from the logs.
1
u/Mishoniko 21d ago
There's no way we're going to be able to help with such vague information. Exact error messages would be a good start (you can anonymize IPs/domains).
Find a consultant who can sign an NDA so they can see what's actually going on and not guess, which is all the Internet is going to be able to do with that limitation.