Question

A financial services company runs a high-throughput trading API behind a Network Load Balancer (NLB). Currently, the NLB uses a TCP listener on port 443 and passes encrypted traffic through to the EC2 backends, which perform TLS termination. The security team wants to centralize certificate management using AWS Certificate Manager (ACM) and reduce CPU load on the backend instances, while keeping the NLB (not an ALB) as the entry point to preserve ultra-low latency and static IP addresses. Which implementation meets these requirements?

Accepted Answer

Change the NLB listener to a TLS listener on port 443, attach an ACM certificate to the listener, and configure the target group to forward decrypted traffic to the backends over TCP.

Answer

Keep the TCP passthrough listener and install the ACM certificate directly on each EC2 instance using the ACM export feature.

Answer

Replace the NLB with an Application Load Balancer using an HTTPS listener and an ACM certificate, then place the ALB behind a Global Accelerator for static IPs.

Answer

Add a TLS listener to the NLB but configure the target group protocol as TLS so traffic is re-encrypted to the backends, offloading nothing from the instances.