DNS với Cloudflare (AWS Certificate Manager)

Mục tiêu Task 2

Chuẩn bị DNS foundation cho VinaShoes E-commerce:

1. Đăng ký domain vinashoes.org từ Cloudflare Registrar (auto-renew + WHOIS privacy)
2. Setup DNS strategy với Cloudflare DNS (DNS-Only mode)
3. Request ACM certificates cho Frontend (us-east-1) và Backend (ap-southeast-1)
4. Xác định redirect plan (www → apex, HTTP → HTTPS)
5. Testing & validation DNS và certificates

Kiến trúc DNS

Domain Registration: Cloudflare Registrar ($7.5/năm)
         ↓
DNS Management: Cloudflare DNS (Free, DNS-only mode)
         ├── vinashoes.org → (Task 3: Frontend deployment)
         ├── www.vinashoes.org → (Task 3: Redirect setup)  
         ├── api.vinashoes.org → (Task 4: Backend API)
         ├── assets.vinashoes.org → (Task 5: Assets CDN)
         └── ACM validation records → (Task 2: Certificate validation)

DNS Records Plan (sẽ tạo sau khi có endpoints):
├── A/CNAME: @ → (Task 3 sẽ provide CloudFront domain)
├── CNAME: www → (Task 3 sẽ provide CloudFront domain)
├── CNAME: api → (Task 4 sẽ provide API Gateway domain)
├── CNAME: assets → (Task 5 sẽ provide S3/CloudFront domain)
└── CNAME: _validation → ACM validation targets (Task 2)

Certificates (Task 2):
├── Frontend: us-east-1 (for future CloudFront)
└── Backend: ap-southeast-1 (for future API Gateway)

Lợi ích approach này:

• ✅ Immediately available - không đợi 60 ngày ICANN transfer
• ✅ Cost effective - chỉ $7.5/năm vs $18/năm với Route 53
• ✅ No CDN conflicts - Cloudflare DNS-only, ready cho AWS CDN services
• ✅ AWS integration - ACM validation, custom domains sẽ work perfect
• ✅ Performance - Cloudflare DNS fastest global resolution
• ✅ Reliability - Cloudflare 100% uptime SLA

1. Đăng ký Domain từ Cloudflare

1.1. Tại sao chọn Cloudflare Registrar?

Domain Registration Benefits:

• ✅ At-cost pricing: $7.5/năm cho .org (không markup)
• ✅ Free WHOIS privacy: Protection tự động, không phí
• ✅ Auto-renew reliable: Không lo quên gia hạn
• ✅ Cloudflare DNS integration: Native support, không config phức tạp

1.2. Process đăng ký domain

Console Steps:

Bước 1: Đăng ký/Đăng nhập Cloudflare Account

Account Setup Process:

1. Access Cloudflare Website:
   • Truy cập cloudflare.com
   • Click “Sign up” nếu chưa có account
   • Hoặc “Log in” nếu đã có account

2. Create New Account (if needed):
   • Enter email address
   • Create strong password
   • Accept terms of service
   • Click “Sign up”

Bước 2: Truy cập Domain Registration

Console Navigation:

1. Navigate to Domain Registration:
   • From dashboard sidebar → “Domain Registration”
   • Hoặc click “Register Domain” button
   • Hoặc trực tiếp: https://dash.cloudflare.com/sign-up/domain

2. Domain Registration Interface:
   • Verify access to domain registration portal
   • Check available features and pricing
   • Prepare for domain search

Bước 3: Search domain vinashoes.org

Domain Search Process:

1. Enter Domain Name:
   • Nhập vinashoes.org trong search box
   • Click “Search” để check availability

2. Check Availability:
   • Verify domain available
   • Check price: $7.5/năm cho .org domain
   • View alternative suggestions if needed

3. Confirm
   • Click “Confirm” nếu available
   • Review pricing details
   • Proceed to configuration

Bước 4: Complete registration

Payment Process:

1. Enter Payment Details:

   • Credit card hoặc PayPal
   • Billing information
   • Tax calculations if applicable

2. Complete Purchase:

   • Final review của order
   • Click “Complete Purchase”
   • Wait for confirmation

3. Registration Confirmation:
   • Domain active trong 15 phút
   • Email confirmation
   • DNS management ready

2. Setup DNS Strategy: Cloudflare DNS-Only

2.1. Tại sao chọn Cloudflare DNS-Only?

2.2. DNS-Only vs Proxied Mode

DNS-Only Mode (Required cho AWS):

Client → Cloudflare DNS resolution → AWS Services (future)

• ✅ Chỉ resolve DNS, không proxy traffic
• ✅ AWS services sẽ receive direct traffic
• ✅ ACM certificates work properly
• ✅ No conflicts với AWS CDN services

Proxied Mode (KHÔNG dùng cho AWS):

Client → Cloudflare CDN → AWS (conflicts)

• ❌ Double CDN = performance issues
• ❌ SSL certificate conflicts
• ❌ AWS services không receive original IP
• ❌ Complications với custom domains

So sánh chi tiết các options:

2.3. DNS Records Strategy (Implementation trong Task 3/4/5)

DNS Records Plan cho Future Tasks:

Task 2 chỉ chuẩn bị DNS strategy, KHÔNG tạo actual records:

• Frontend Records (Task 3): vinashoes.org, www.vinashoes.org → CloudFront domain
• Backend Records (Task 4): api.vinashoes.org → API Gateway domain
• Assets Records (Task 5): assets.vinashoes.org → CloudFront domain
• ACM Validation Records (Section 3): _validation-xyz.vinashoes.org → ACM targets

Current DNS Status:

Domain: vinashoes.org (registered, DNS ready)
Nameservers: Cloudflare (xxx.ns.cloudflare.com)
DNS Management: Active, ready for future records
Target Mode: DNS-Only (proxy OFF when created)

3. Xin ACM Certificates

3.1. Frontend Certificate (us-east-1)

Lý do us-east-1: CloudFront chỉ accept certificates từ us-east-1.

Bước 1: Truy cập ACM Console (us-east-1)

Console Navigation:

1. Access AWS Console:
   • Đăng nhập AWS Console
   • Quan trọng: Chuyển region sang us-east-1 (N. Virginia)
   • Search “Certificate Manager” → Click vào service

2. Access Certificate Manager:
   • From AWS Console search bar
   • Type “Certificate Manager”
   • Click on AWS Certificate Manager service

Bước 2: Request Certificate

Certificate Request Process:

1. Start Certificate Request:
   • Click “Request certificate” button
   • Choose certificate type

2. Certificate Type Selection:
   • ☑️ Request a public certificate (đã chọn sẵn)
   • ☐ Request a private certificate (disabled - không có private CA)
   • Click “Next”

Bước 3: Domain names configuration

Domain Configuration:

1. Primary Domain Entry:
   • Fully qualified domain name: Nhập www.vinashoes.org (domain chính)
   • Click “Add another name to this certificate” để thêm domains

• Add vinashoes.org (apex domain)
• Each domain sẽ có separate input field

Bước 4: Allow export configuration

Export Settings:

1. Certificate Export Options:
   • ☑️ Disable export (recommended cho CloudFront)
   • ☐ Enable export (cho external TLS workflows)
   • Description: “Use this certificate only with integrated AWS services”

Bước 5: Validation method

Validation Method Selection:

1. Choose Validation Type:
   • ☑️ DNS validation - recommended (đã chọn)
   • ☐ Email validation
   • Description: “Choose this option if you are authorized to modify the DNS configuration”

Bước 6: Key algorithm

Algorithm Configuration:

1. Key Algorithm Selection:
   • ☑️ RSA 2048 (recommended, đã chọn sẵn)
   • ☐ ECDSA P 256 (Equivalent in cryptographic strength to RSA 3072)
   • ☐ ECDSA P 384 (Equivalent in cryptographic strength to RSA 7680)
   • Description: “RSA is the most widely used key type”

Bước 7: Tags configuration

Tags Configuration:

1. Optional Tags:
   • Click “Add new tag” nếu muốn thêm tags
   • No tags associated with the resource (default)
   • You can add up to 50 tags
   • Example tags:
     • Key: Project, Value: VinaShoes
     • Key: Environment, Value: Production

Bước 8: Review và Request

1. Submit Request:
   • Click “Request” (orange button) để submit
   • Certificate creation processing
   • Alternative: Click “Previous” để quay lại chỉnh sửa

2. Request Result:
   • Certificate được tạo với status “Pending validation”
   • Copy certificate ARN for reference
   • Proceed to DNS validation

3.2. Backend Certificate (ap-southeast-1)

3.3. DNS Validation qua Cloudflare

Bước 1: Lấy DNS validation records từ ACM

Console Steps:

1. Access Certificate Details:
   • Return to Certificate Manager (us-east-1 for Frontend)
   • Click vào certificate ID để xem chi tiết
   • Navigate to “Domains” section

2. View Validation Records:
   • Trong section “Domains”, bạn sẽ thấy:
     • Domain: vinashoes.org
     • Status: ⏳ Pending validation
     • CNAME name: (copy value này)
     • CNAME value: (copy value này)

Bước 2: Tạo CNAME validation records trong Cloudflare

Console Steps:

1. Access Cloudflare DNS Management:
   • Vào Cloudflare Dashboard
   • Chọn domain vinashoes.org
   • Click tab “DNS”

2. Add New DNS Record:
   • Click “Add record” button
   • Prepare to add CNAME validation record

3. Configure CNAME Record:
   • Type: Select CNAME từ dropdown
   • Name: Copy từ “Record Name” (bỏ phần .vinashoes.org)
     • Ví dụ: _abc123def456ghi789jkl
   • Target: Copy từ “Record Value”
     • Ví dụ: _xyz789abc123def456ghi.acm-validations.aws.

4. Critical Settings:
   • Proxy status: 🚫 DNS only (cloud xám) - QUAN TRỌNG!
   • TTL: Auto hoặc 1 minute for faster validation
   • Double-check all values exactly match ACM

5. Save DNS Record:
   • Review all settings
   • Click “Save”
   • Record appears in DNS records list

6. Verify DNS Record Created:
   • Check DNS records list
   • Confirm CNAME record visible
   • Note “DNS only” status (gray cloud)

Bước 3: Đợi validation complete

Console Monitoring:

1. Return to ACM Console:
   • Back to Certificate Manager
   • Refresh certificate details page
   • Monitor validation status

2. Validation Progress:

   • Domain status từ ⏳ “Pending validation”
   • Process thường mất 5-15 phút
   • AWS validates DNS record propagation

3. Validation Success:

   • Domain status → ✅ “Success”
   • Certificate status → “Issued”
   • Certificate ready for use

4. Certificate Issued Confirmation:
   • Full certificate details available
   • ARN ready for AWS services
   • Valid for 13 months

Alternative: AWS CLI method

# Lấy validation records cho frontend certificate (us-east-1)
aws acm describe-certificate \
  --certificate-arn "arn:aws:acm:us-east-1:577638368374:certificate/abc123" \
  --region us-east-1 \
  --query 'Certificate.DomainValidationOptions[0].ResourceRecord'

# Lấy validation records cho backend certificate (ap-southeast-1)  
aws acm describe-certificate \
  --certificate-arn "arn:aws:acm:ap-southeast-1:577638368374:certificate/def456" \
  --region ap-southeast-1 \
  --query 'Certificate.DomainValidationOptions[0].ResourceRecord'

4. Redirect Plan

5. Testing & Validation

DNS Infrastructure:

nslookup -type=NS vinashoes.org

Expected: Cloudflare nameservers

Certificate Status:

• AWS Console → Certificate Manager
• us-east-1: vinashoes.org, www.vinashoes.org, assets.vinashoes.org = “Issued”
• ap-southeast-1: api.vinashoes.org = “Issued”

Kết quả Task 2

✅ Domain: vinashoes.org registered ($7.5/năm) ✅ DNS: Cloudflare DNS ready cho AWS integration
✅ Certificates: Frontend + Backend certificates issued ✅ Plan: Redirect strategy documented