What domain to set up SSL certificate on for Internet-facing AWS Elastic Load Balancer?

Question

I have a React app that pings a Node Express server (REST api, HTTP) running on an EC2 instance for data services. I want to support HTTPS, so I was hoping to get a certificate installed on an Elastic Load Balancer and use that for SSL termination. So the React app would ping the ELB on HTTPS, which would forward and talk to the Express server on HTTP.

The issue: what domain should I make the certificate on? The public DNS of the ELB? Amazon says I can't get an SSL cert on an Amazon-owned DNS: https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-requests.html#failed-additional-verification-required

If I can't get an SSL cert on the ELB's public DNS... how can it support internet-facing HTTPS? Is there something I'm not understanding?

Answer 1

It's true. You cannot get an SSL certificate for the amazonaws.com endpoint on an ELB/ALB.

However, Amazon Elastic Load Balancers and Application Load Balancers will accept connections as any domain, not just amazonaws.com, as long as they are resolving to the ELB/ALB.

So you need to do the following:

1. Buy and register a domain of your own using Route 53.
2. Point your domain to your ELB/ALB. Ensure you can access your React app using your own domain (and not the amazonaws.com one).
3. Create an SSL certificate for your own domain via ACM.
4. Attach your SSL certificate to your ELB/ALB.

Note: Registering your domain via Route 53 is not required; any DNS registrar will do. But using Route 53 provides an "all-in-one" solution.