Question

A media company is deploying a new public-facing web application behind an Application Load Balancer (ALB). The security team requires that all data in transit to end users be encrypted with TLS 1.3, that the private key material for the server certificate never be exposed to or exportable by application teams, and that certificate renewal be fully automated with zero manual intervention. The application will serve users globally, and the team wants the lowest operational overhead. Which approach best meets these requirements?

Accepted Answer

Request a public certificate from AWS Certificate Manager (ACM), associate it with the ALB HTTPS listener, and configure a modern TLS security policy that supports TLS 1.3.

Answer

Generate a certificate and private key with OpenSSL, store the key in AWS Secrets Manager, and have a Lambda function import the certificate into ACM before each renewal.

Answer

Purchase a certificate from a third-party CA, upload it to ACM via import, and build an EventBridge rule that emails the team 30 days before expiration to renew manually.

Answer

Terminate TLS on EC2 instances behind a Network Load Balancer, storing the private key on encrypted EBS volumes and rotating it with a cron job.