7

I have an Application Load Balancer (ALB) that uses the default DNS name provided by AWS.

i.e. name of my-loadbalancer in US East is given the DNS name:

my-loadbalancer-1234567890.us-east-1.elb.amazonaws.com

basic configuration

I have a listener over HTTP that works just fine:

http://my-loadbalancer-1234567890.us-east-1.elb.amazonaws.com/

However, when I go to add an HTTPS Listener, I need to provide a certificate that matches the current domain. I can pick something from my ACM store, but they're all for custom domains

HTTPS Listener

I can request a new certificate, but not sure how I'd be able to validate against ***.us-east-1.elb.amazonaws.com

This is a backend service, so I don't need a user friendly domain.

Is there anyway to add HTTPS to a load balancer out of the box?

KyleMit
  • 30,350
  • 66
  • 462
  • 664
  • Maybe Related to [Install Wildcard Certificate onto AWS EC2 Load Balancer](https://stackoverflow.com/a/11469631/1366033) – KyleMit Nov 04 '20 at 16:45

1 Answers1

5

You can add any ACM certificate you have to a listener, after all this load balancer is a CNAME and would be resolved to your hostname(s) via a DNS record.

However for any ACM certificate you have to be able to verify that you control that domain. As the load balancers domain is owned by Amazon you cannot verify this domain. If you attempt to access the load balancers CNAME directly in the browser it will show as insecure (as the SSL will not be valid for that domain), you will however be able to verify HTTPS works.

The only solution to have a valid HTTPS endpoint will be to use an ACM certificate for a domain you own, and resolve it via that domain name rather than the load balancers CNAME.

Chris Williams
  • 32,215
  • 4
  • 30
  • 68
  • 3
    For those who come across this in the future, you can setup a domain via this guide on [**Routing traffic to an ELB load balancer**](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-elb-load-balancer.html) on **Route 53** – KyleMit Nov 04 '20 at 20:15
  • 1
    Is there any simpler way to configure a valid HTTPS endpoint for an ELB as of 2022? Would rather avoid paying R53 just to avoid the google complaint page on a backend service. Thanks – bracec Mar 21 '22 at 15:11