Yes, ELBs support decrypting the SSL request and sending a plain http request back to your Apache back end servers.
The ELB will add both X-Forwarded-For
and X-Forwarded-Proto
headers so you can tell the difference between SSL requests and plain http requests. The non-SSL requests may only have the X-Forwarded-For
header or may have the X-Forwarded-Proto
header set to http
.
If your Apache is receiving requests on port 443, the ELB can't be injecting any headers and your logs will only ever contain the IP address of the load balancer itself. You have to do SSL termination in the ELB to get the X-Forwarded-For
header.
There's a decent tutorial here. There's also an answer specifically for Thawte here.