Question

A financial services company runs a web application behind an Application Load Balancer (ALB) in a public subnet, with EC2 instances in private subnets. Compliance requires that all client traffic to the application be encrypted in transit using a publicly trusted certificate, and the security team wants to minimize the operational overhead of certificate renewal. Which solution meets these requirements?

Accepted Answer

Request a public certificate from AWS Certificate Manager (ACM) and attach it to an HTTPS listener on the ALB; ACM automatically renews the certificate.

Answer

Generate a self-signed certificate on each EC2 instance and configure the ALB to forward encrypted TCP traffic to the instances.

Answer

Purchase a certificate from a third-party CA, upload it to AWS Secrets Manager, and reference it from the ALB HTTPS listener.

Answer

Import a certificate into ACM from an external CA and attach it to the ALB, then manually re-import a new certificate before each expiration.