Starting to setup a Load Balanser in AWS, I ran into some additional questions.
Basically I have a web site/app deployed in an EC2 instance. I'd like to make it secure by using an AWS generated cert via Certificate Manager. As I already have understood EC2 cannot itself manage this and one easy way to enable it would be to deploy a Load Balancer in front of EC2 which secures the client communication with my ACM certificate.
Maybe easy, but not for me...
QUESTION 1: Since I don't want to deploy multiple EC2 instances I need to deploy a "Classic Load Balancer" instead of an "Application Load Balancer" (since the latter requires at least 2 EC2 instances). Is this correct?
QUESTION 2: I want the visitors of the web site to get the "secure" indication in their browsers. I assume this means I need to use HTTPS all the the way client <-> Load Balancer <-> EC2, and cannot terminate the SSL/HTTPS in the LB. Is this a correct assumption?
QUESTION 3: If the previous assumption is correct, should I then use another certificate for the HTTPS communication between the Load Balancer and EC2? Afaiu the one I have in ACM cannot be used. Would the correct way be to generate a new, private certificate in ACM to use for this?
QUESTION 4: If so, would a private certificate still give the end-user the benefit of a fully signed certificate, or would it be seen as a self-signed cert (which I don't want)?
QUESTION 5: Maybe totally wrong (and showing how much I really know about certifiates ;-) but since I already have another ssh-certificate (from my IAM user, which I use to ssh to the ec2 instance) on the ec2 instance, could this one be used in the Load Balancer <-> EC2 step?
Ok, that's all I think, at least for now... Thanks!
UPDATE Thanks to the helpful answers I got this to work, and turns out easier than I thought when writing the original question. I just launched an "Application Load Balancer" with http an https listeners with my ACM cert, keeping all the default options. Adding a CNAME entry in my external DNS to my loadbalancer's DNS name and the SSL works just fine.