Create a Secure HTTPS Listener on an AWS Application Load Balancer – SAP-C02 Study Guide

Purpose of This Lesson

A production Application Load Balancer (ALB) should normally expose an HTTPS endpoint rather than relying only on HTTP. This lesson demonstrates the complete workflow:

• Deploy an ALB and supporting resources with AWS CloudFormation.
• Request and validate a public TLS certificate with AWS Certificate Manager (ACM).
• Add an HTTPS listener on port 443.
• Point a Route 53 DNS name to the ALB using an alias record.
• Verify encrypted access and clean up the lab safely.

The same design applies to many SAP-C02 scenarios involving secure web applications, certificate management, DNS, and infrastructure as code.

Key Concepts

Application Load Balancer and HTTPS listeners

An ALB listener checks incoming connection requests on a protocol and port. A common configuration uses:

• HTTP listener on port 80.
• HTTPS listener on port 443.
• Both listeners forwarding to the same target group, when the application does not require different routing behavior.

The HTTPS listener terminates TLS at the load bal balancer. The ALB decrypts the request and forwards it to the registered targets according to the target group’s protocol and port. If end-to-end encryption is required, the target group can also use HTTPS, but the targets then need their own server-side certificate and appropriate configuration.

The listener requires an SSL/TLS certificate and a security policy. The security policy controls supported TLS versions and cipher suites. In most cases, use the current AWS-recommended default unless compatibility requirements dictate otherwise.

AWS Certificate Manager public certificates

ACM issues and manages public certificates for domain names that you control. A certificate can cover:

• An exact name such as www.example.com.
• Multiple names through Subject Alternative Names (SANs).
• A wildcard such as *.example.com, subject to wildcard matching rules.

For a public certificate, domain ownership must be validated. DNS validation is generally preferred because it is automated, repeatable, and supports automatic renewal while the validation record remains in place.

With Route 53, ACM can create the required validation CNAME record automatically when the certificate and hosted zone are in an account and region configuration that permits it. The certificate changes from Pending validation to Issued after ACM detects the record. DNS propagation can introduce a short delay.

Certificate and load balancer regions

An ACM certificate used by an ALB must be issued in the same AWS Region as the load balancer. A certificate in us-east-1, for example, cannot normally be attached to an ALB in eu-west-1.

This is a frequent exam and implementation error. CloudFront is different: certificates used with CloudFront must be provisioned in us-east-1.

Route 53 alias records

The ALB has an AWS-generated DNS name, but clients should use the application domain covered by the certificate. Create a Route 53 alias A record, such as:

app.example.com -> Application Load Balancer

An alias record is preferable to a CNAME at the zone apex because Route 53 supports aliases for AWS resources and aliases can be used at the root domain. Route 53 alias queries to supported AWS resources do not incur the same per-query charge as standard DNS queries.

The DNS name used by the client must match a name on the certificate. Connecting to the ALB’s generated DNS name will generally produce a certificate-name mismatch unless that name is covered by the certificate, which it normally is not.

CloudFormation parameters and resource lifecycle

A CloudFormation template can create the ALB, listeners, target group, Auto Scaling group, subnets, and security groups as one managed stack. Parameters make the template reusable by allowing deployment-time selection of values such as:

• VPC ID.
• Subnet IDs in different Availability Zones.
• AMI ID.
• Instance type.

Use parameters rather than hard-coding environment-specific values. For repeatable production deployments, parameter values can be managed through deployment pipelines, Systems Manager Parameter Store, or CloudFormation templates and configuration files.

Deleting the CloudFormation stack should remove resources created by the stack, provided they have not been modified or retained by a deletion policy. Resources changed manually after deployment may cause deletion failures or leave dependencies that require remediation.

Security group requirements

The ALB security group must allow inbound traffic on the listener ports required by clients, commonly:

• TCP 443 from approved client CIDR ranges or from the internet for a public application.
• TCP 80 only when HTTP is intentionally supported or redirected to HTTPS.

The target instance security group should allow application traffic only from the ALB security group, not from arbitrary internet addresses. For example:

• ALB security group: inbound 443 from clients.
• Instance security group: inbound application port from the ALB security group.

Security groups are stateful, so return traffic for an allowed connection is automatically permitted, subject to the relevant rules.

Exam-Relevant Takeaways

• An ALB HTTPS listener requires an ACM certificate, an IAM certificate, or an imported certificate.
• A public ACM certificate must be validated before it can be attached to the listener.
• DNS validation is usually more operationally reliable than email validation.
• Keep the ACM DNS validation CNAME record in place so ACM can automatically renew the certificate.
• The ACM certificate and ALB must be in the same Region.
• Use a Route 53 alias record to map the application name to an ALB.
• The certificate name must match the DNS name clients use.
• An HTTPS listener commonly forwards to an existing target group; HTTPS at the edge does not automatically encrypt traffic between the ALB and targets.
• Open the correct port in the ALB security group. A listener can exist while remaining unreachable because its security group blocks the traffic.
• Prefer CloudFormation or another IaC tool for deployments that must be repeatable, auditable, and removable.
• ACM public certificates do not require a separate per-certificate monthly charge; normal Route 53, load balancer, data transfer, and other applicable AWS charges still apply.

Architecture Decision Guide

Requirement	Recommended design	Important consideration
Public web endpoint needs encryption	ALB HTTPS listener on 443 with an ACM public certificate	Certificate must cover the client-facing DNS name
Automated certificate ownership validation	ACM DNS validation with a Route 53 CNAME	Do not remove the validation record if automatic renewal is needed
DNS name for an ALB	Route 53 alias A or AAAA record	Alias records can target the ALB and work at the zone apex
HTTP clients should be upgraded to HTTPS	Port 80 listener that redirects to 443	Avoid serving sensitive content over the HTTP listener
ALB in one Region, certificate in another	Request or import the certificate in the ALB’s Region	Cross-Region ACM certificates cannot be attached directly
Encrypt traffic only from client to ALB	HTTPS listener with HTTP target group	Suitable only when the internal network and threat model permit HTTP
Encrypt traffic through the entire path	HTTPS listener and HTTPS target group	Configure target certificates and trust behavior appropriately
Restrict backend access	Instance security group allows traffic from ALB security group	Do not use broad internet CIDR rules for backend application ports
Repeatable multi-environment deployment	CloudFormation template with parameters	Manage parameter values and avoid manual drift

Common Exam Traps

Confusing the certificate name with the ALB DNS name

The certificate should cover the domain clients enter, such as app.example.com. The ALB’s AWS-generated DNS name is only the load balancer endpoint and is not normally the name users should access.

Assuming DNS validation is instantaneous

The ACM certificate may remain pending while DNS records propagate. Verify that the CNAME exists in the authoritative hosted zone and that it was not accidentally created in a similarly named or private hosted zone.

Removing the ACM validation record after issuance

A certificate can be issued successfully and still fail to renew later if the validation CNAME is deleted. Keep it in DNS for the life of the certificate.

Forgetting the Region constraint

A certificate in us-east-1 is not automatically usable by an ALB in another Region. Always identify the ALB Region before requesting the certificate.

Opening port 443 on the wrong security group

The listener’s security group controls client-to-ALB access. The target security group controls ALB-to-instance access. Updating only the instance security group does not make the ALB listener reachable.

Treating HTTPS termination as end-to-end encryption

TLS termination at the ALB means the ALB decrypts traffic. If compliance or threat modeling requires encrypted traffic to the targets, configure HTTPS between the ALB and the target group as well.

Deleting Route 53 zone records indiscriminately

When cleaning up validation or application records, remove only the records created for the lab or application. Do not delete the hosted zone’s required NS and SOA records unless you intend to remove the hosted zone itself.

Assuming CloudFormation always deletes every resource

Manual changes, dependencies, retained resources, or resources created outside the stack can prevent clean deletion. Inspect CloudFormation events and resolve the specific dependency or drift issue.

Real-World Engineer Notes

• Use a port 80 listener that returns a redirect to HTTPS when users may still enter the HTTP URL. This provides a better migration path than simply closing port 80.
• Use ACM-managed certificates wherever possible. They reduce certificate deployment work and support managed renewal when validation remains intact.
• For multiple AWS accounts, centralize DNS where appropriate but ensure the ACM validation process can create or maintain records in the authoritative hosted zone.
• Use CloudFormation change sets, stack policies, and deployment pipelines for production changes rather than editing listeners manually in the console.
• Enable ALB access logs and monitor metrics such as HTTP 4xx, HTTP 5xx, target response time, and rejected connection counts.
• Deploy ALB subnets across at least two Availability Zones. The targets and Auto Scaling group should also span multiple Availability Zones for resilience.
• Use AWS WAF with the ALB when application-layer filtering, managed rule groups, rate-based rules, or IP reputation controls are required.
• For private applications, use an internal ALB and private DNS rather than exposing the load balancer publicly.
• If a single domain serves different applications, use listener rules based on host headers or paths and attach certificates that cover all required hostnames.

Quick Reference Summary

1. Deploy the ALB and related resources with CloudFormation.
2. Choose a VPC and subnets in multiple Availability Zones.
3. Request a public ACM certificate in the ALB’s Region.
4. Use DNS validation and create the ACM CNAME in Route 53.
5. Wait until the certificate status is Issued.
6. Add an ALB HTTPS listener on port 443.
7. Select the ACM certificate and forward requests to the target group.
8. Permit 443 in the ALB security group.
9. Permit backend traffic from the ALB security group in the target security group.
10. Create a Route 53 alias record for the application domain.
11. Test with https://your-domain.example and verify the certificate and response.
12. Remove the application record and delete the CloudFormation stack when the lab is complete.

Flashcards

1. What does an ALB HTTPS listener require?

An SSL/TLS certificate and a listener security policy, normally listening on port 443.

2. Which ACM validation method is generally preferred for Route 53-managed domains?

DNS validation, because it is automated and supports renewal while the validation CNAME remains present.

3. In which Region must an ACM certificate reside to be attached to an ALB?

The same Region as the ALB.

4. Why should clients use the application domain instead of the ALB DNS name?

The certificate is issued for the application domain, so using the ALB DNS name can cause a certificate hostname mismatch.

5. Which Route 53 record type is commonly used for an ALB?

An alias A record, or an alias AAAA record when IPv6 access is required.

6. What does TLS termination at the ALB mean?

The ALB decrypts client traffic before forwarding the request to the target group.

7. Does an HTTPS listener automatically encrypt ALB-to-target traffic?

No. The target group must be configured for HTTPS if encryption to the targets is required.

8. Which security group should allow inbound port 443 from clients?

The ALB security group.

9. What should the target instance security group use as its source for application traffic?

The ALB security group, rather than a broad client or internet CIDR range.

10. Why retain the ACM DNS validation CNAME?

ACM uses it to verify continued domain control and support automatic certificate renewal.

11. What problem does a CloudFormation parameter solve?

It allows deployment-specific values, such as VPC, subnet, AMI, and instance type, to be supplied without changing the template.

12. What is a common purpose for an HTTP listener when HTTPS is enabled?

Redirecting HTTP requests on port 80 to HTTPS on port 443.

Practice Questions

Question 1

A company requests an ACM public certificate for app.example.com in us-east-1. Its public ALB is deployed in eu-west-1, and the certificate does not appear in the ALB listener certificate list. What should the architect recommend?

Correct answer: Request or import the certificate in eu-west-1 and validate that certificate.

Explanation: An ACM certificate used by an ALB must be in the same Region as the load balancer. The existing us-east-1 certificate cannot be attached directly to the ALB in eu-west-1.

Question 2

An ALB has an active HTTPS listener and an issued ACM certificate, but clients receive connection timeouts when accessing https://app.example.com. The target instances allow inbound traffic on the application port. Which change is most likely required?

Correct answer: Add an inbound TCP 443 rule to the ALB security group for the approved client source.

Explanation: The target security group does not control client-to-ALB access. The ALB security group must permit traffic on the listener port.

Question 3

A security requirement states that traffic must be encrypted from internet clients through the ALB to the EC2 targets. Which configuration satisfies the requirement?

Correct answer: Configure an HTTPS listener on the ALB and an HTTPS target group with appropriate target-side TLS configuration.

Explanation: HTTPS on the client-facing listener encrypts only the client-to-ALB segment. An HTTPS target group is required to encrypt the ALB-to-target segment as well.

Question 4

An organization wants a DNS name at the root of example.com to resolve to a public ALB. Which record should be created in Route 53?

Correct answer: An alias A record targeting the ALB.

Explanation: A standard CNAME cannot be used at the zone apex, while Route 53 alias records can target supported AWS resources such as an ALB and can be used at the root domain.

Question 5

An ACM certificate was successfully issued using DNS validation. An administrator deletes the validation CNAME because the certificate is already active. What is the likely consequence?

Correct answer: ACM may be unable to automatically renew the certificate when renewal becomes due.

Explanation: The validation record demonstrates continued control of the domain. It should remain in the authoritative DNS zone for managed renewal.