TLS & Zertifikate für AWS CloudFront

# terraform/tls.tf — ACM + CloudFront TLS
resource "aws_acm_certificate" "main" {
  provider          = aws.us_east_1
  domain_name       = "ihre-domain.de"
  validation_method = "DNS"

  subject_alternative_names = [
    "*.ihre-domain.de",
  ]

  lifecycle {
    create_before_destroy = true
  }
}

# DNS-Validierungsrecord in Route 53
resource "aws_route53_record" "cert_validation" {
  for_each = {
    for dvo in aws_acm_certificate.main.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  zone_id = aws_route53_zone.main.id
  name    = each.value.name
  type    = each.value.type
  ttl     = 60
  records = [each.value.record]
}

# CloudFront mit TLS 1.2+ und HTTPS-Redirect
resource "aws_cloudfront_distribution" "main" {
  viewer_certificate {
    acm_certificate_arn      = aws_acm_certificate.main.arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }

  default_cache_behavior {
    viewer_protocol_policy = "redirect-to-https"
  }
}

# TLS-Version prüfen
curl -sI -v https://ihre-domain.de 2>&1 | grep "SSL connection"

# Erwartete Ausgabe:
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256

# Zertifikat-Details prüfen
echo | openssl s_client -connect ihre-domain.de:443 \
  -servername ihre-domain.de 2>/dev/null | \
  openssl x509 -noout -dates -issuer

# Erwartete Ausgabe:
notBefore=Mar 29 00:00:00 2026 GMT
notAfter=Apr 28 23:59:59 2027 GMT
issuer=CN = Amazon RSA 2048 M03, O = Amazon, C = US

# HTTP-Redirect prüfen
curl -sI http://ihre-domain.de | head -3

# SSL Labs Test (Note A+ erreichbar)
# https://www.ssllabs.com/ssltest/analyze.html?d=ihre-domain.de