Question

A SysOps administrator must enable HTTPS for a public-facing web application served by an Application Load Balancer (ALB). Security requires that the TLS certificate be automatically renewed to avoid expiration-related outages, and that no certificate private keys are ever stored on or accessible by the EC2 instances. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Request a public certificate from AWS Certificate Manager (ACM) in the same Region as the ALB and associate it with an HTTPS listener on the ALB.

Answer

Purchase a certificate from a third-party CA, install it on each EC2 instance, and configure the ALB to pass TLS traffic through to the instances.

Answer

Import a self-signed certificate into ACM and attach it to the ALB HTTPS listener, then set a calendar reminder to reimport before expiry.

Answer

Request a public certificate from ACM in us-east-1 and reference it from the ALB regardless of the ALB's Region to enable automatic renewal.