---
title: Setting up AWS CloudFront with Blossom
url: "/docs/cdn/cloudfront/"
canonical_url: https://docs.blossom88.com/docs/cdn/cloudfront/
markdown_url: https://docs.blossom88.com/docs/cdn/cloudfront.md
summary: Learn how to set up AWS CloudFront as a CDN in front of your Blossom application
categories:
- aws
- cdn
- cloudfront
- security
---

# Setting up AWS CloudFront with Blossom

This guide walks you through setting up AWS CloudFront as a Content Delivery Network (CDN) in front of your Blossom application.

## Prerequisites

- A Blossom application
- A domain (e.g., `mysite.com`)
- AWS CloudFront distribution

## Configuration Steps

### 1. DNS Configuration

1. Create a CNAME record for your domain pointing to your CloudFront distribution:

   ```
   mysite.com -> d34jqxq7ceb9eo.cloudfront.net (CNAME)
   ```

2. Create a subdomain for the Blossom origin:
   ```
   origin.mysite.com -> [Origin target shown by Blossom]
   ```

### 2. CloudFront Configuration

1. Create a CloudFront distribution with the following settings:
   - Origin domain: `origin.mysite.com`
   - Origin protocol: HTTP only
   - Viewer Protocol Policy: "Redirect HTTP to HTTPS"

### 4. Blossom Domains

Configure two domains in your Blossom application:

1. `mysite.com` (HTTP Only)
2. `origin.mysite.com` (HTTP Only)




<aside class="docs-callout not-typography" data-tone="info">
  
  <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke="currentColor" aria-hidden="true"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"></path></svg>
  
  <div class="docs-callout-body">
    
    <div class="info-content">
      
You'll also need to add the `mysite.com` Domain because CloudFront sends that
Host header to the origin. DNS points public traffic to CloudFront, while the
Blossom Domain allows the matching origin request.

    </div>
  </div>
</aside>


## Important Notes

- CloudFront communicates with the configured Blossom origin using HTTP
- End users access the site via HTTPS
- CloudFront automatically redirects HTTP to HTTPS for end users
- Self-signed Blossom origin certificates are not supported by CloudFront
- For HTTPS between CloudFront and the origin, use a Blossom Domain with a
  publicly trusted certificate

### Rails CDN SSL Configuration

When a CDN terminates HTTPS before forwarding a request to Rails, tell Rails
whether the origin connection is HTTP or HTTPS.

- If the Blossom Domain uses **HTTP Only**, set `CDN_TERMINATES_SSL=true`.
- If the CDN uses HTTPS to reach the Blossom origin, leave the variable unset.

Keep `force_ssl` enabled in both cases:

`config/environments/production.rb`

```ruby
# Set this only when the CDN accepts HTTPS and sends HTTP to Blossom.
config.assume_ssl = ENV["CDN_TERMINATES_SSL"] == "true"
config.force_ssl = true
```

`assume_ssl` makes Rails treat the forwarded request as HTTPS, preventing a
redirect loop while preserving secure URL and cookie behavior. Configure the
CDN to redirect public HTTP requests to HTTPS.

See the Rails configuration reference for
[`config.assume_ssl`](https://guides.rubyonrails.org/configuring.html#config-assume-ssl)
and [`config.force_ssl`](https://guides.rubyonrails.org/configuring.html#config-force-ssl).


## Debugging Tips

- To test your setup, use:
        curl -svo /dev/null -H "Host: mysite.com" http://origin.mysite.com
- Always include the `Host` header in your requests as CloudFront does
- If experiencing stale content, invalidate the CloudFront cache

## Troubleshooting

- **TLS Handshake Error**: This typically occurs when using a self-signed origin
  certificate. Use a publicly trusted certificate or HTTP between CloudFront
  and the origin.
- **Stale Content**: Use CloudFront cache invalidation to force content refresh.
- **Connection Issues**: Verify DNS records and the Environment's health and origin status.