So, I'm running three EC2 instances behind an AWS load balancer. I want to purchase an SSL certificate to use with these machines. Should I just purchase the certificate for the load balancer's public IP address and install the certificate on each machine? Will this work?
AWS Elastic Load Balancer supports SSL termination at the load balancer. This means you can install your SSL certificate on the load balancer itself. The load balancer will then talk unencrypted HTTP between the load balancer and your EC2 instance.
This way you only have to install the certificate on the ELB instead of every machine. Have your Apache/Nginx/Lighttpd/whatever use plain HTTP, not SSL. Let the load balancer handle all of the SSL.
Definitely terminate the SSL at the load balancer and check x-forwarded-proto header in your code. Installing the SSL cert on ELB is dead easy if you follow this article: http://cloudarch.co.uk/2011/10/elastic-load-balancer-ssl-setup-guide-pem-encoded-csr/#comment-561
Took me about 5 minutes.