Secure Listeners for Elastic Load Balancing: TLS Termination and End-to-End Encryption – SAP-C02 Study Guide

Purpose of This Lesson

Secure listeners protect data in transit between clients, load balancers, and application targets. The correct design depends on whether TLS terminates at the load balancer, continues through to the target, or is passed through without termination.

For the SAP-C02 exam, distinguish carefully between:

• TLS termination at an Application Load Balancer (ALB) or Network Load Balancer (NLB).
• A separate connection from the load balancer to the target.
• TLS pass-through through an NLB.
• Certificate storage and private-key export limitations.

Key Concepts

TLS termination at the load balancer

When a client connects to an HTTPS or TLS listener, the load balancer presents a certificate and decrypts the request. The load balancer then creates a separate connection to the target.

This results in two independent connections:

1. Client to load balancer.
2. Load balancer to application target.

The first connection is encrypted. The second connection can use either plaintext or TLS, depending on the target group protocol and security requirements.

ALB with HTTPS termination only

A common ALB design uses:

• An HTTPS listener on the ALB.
• A certificate managed by AWS Certificate Manager (ACM).
• An HTTP target group for communication between the ALB and the application instances.

This encrypts traffic across the internet or other untrusted networks but leaves the load balancer-to-target connection unencrypted.

That may be acceptable when the targets are in a well-controlled VPC and organizational policy permits it. It is not suitable when compliance or security requirements mandate encryption throughout the application path.

ALB with end-to-end encryption

For encryption from the client to the target, configure:

• An HTTPS listener on the ALB.
• An HTTPS target group.
• A certificate on the ALB.
• TLS configured on the application server.

The ALB terminates the client-side TLS session and establishes a new TLS session with the target. This is usually called TLS re-encryption or TLS bridging, rather than one continuous cryptographic session.

The target-side certificate is managed independently from the ALB certificate. It can be issued by a public or private certificate authority, or in some configurations be self-signed if the load balancer does not need to validate it. The important requirement is that the application server has a certificate and private key that it can use.

NLB TLS pass-through

An NLB can forward encrypted traffic without terminating TLS. In this design:

• The client establishes TLS directly with the application.
• The NLB forwards the encrypted bytes at the network layer.
• The application server presents the certificate.
• The NLB cannot inspect HTTP headers or make Layer 7 routing decisions because it does not decrypt the traffic.

This is useful when the application must control the TLS session, when client certificates must be handled by the application, or when TLS termination at the load balancer is undesirable.

The target certificate does not need to be issued by ACM because the certificate is installed and used by the target. It may be a certificate from a public CA, a private CA, or another certificate source appropriate for the client trust model.

NLB TLS termination and re-encryption

An NLB can also terminate TLS on a TLS listener and establish a second encrypted connection to targets using a TLS target group.

This provides:

• TLS encryption from the client to the NLB.
• A separate TLS connection from the NLB to the target.
• Certificate management at both the load balancer and application layers.

The frontend certificate can be stored in ACM. The backend certificate is installed and managed on the target servers.

AWS Certificate Manager considerations

ACM is the normal choice for certificates used directly by AWS-integrated load balancers. ACM can issue certificates, import certificates, and automate renewal for eligible certificates.

A key operational distinction is that the private key of a standard ACM-issued public certificate is not available for export and installation on an EC2 instance. If a target must terminate TLS itself, obtain and manage a certificate through a mechanism that permits installation on the target, such as a public CA, AWS Private CA with an appropriate export process, or another internal certificate-management system.

Exam-Relevant Takeaways

• An ALB HTTPS listener terminates the client TLS connection and creates a separate connection to the target.
• ALB frontend encryption does not automatically encrypt traffic between the ALB and its targets.
• Use an HTTPS target group when the ALB-to-target connection must also be encrypted.
• NLB TLS pass-through leaves TLS termination to the target and prevents Layer 7 inspection by the NLB.
• NLB TLS termination uses a certificate on the NLB; use a TLS target group for encrypted backend traffic.
• Certificates used by load balancers are commonly stored in ACM.
• A certificate installed on an EC2 target requires access to the corresponding private key; a non-exportable ACM certificate cannot simply be copied to the instance.
• “End-to-end encryption” in a load-balanced design generally means encrypted client-to-load-balancer and load-balancer-to-target connections, not a single uninterrupted TLS session.
• Select the load balancer and listener type based on the required inspection, routing, certificate ownership, and encryption boundaries.

Architecture Decision Guide

Requirement	Recommended design	Important tradeoff
Encrypt internet traffic and perform HTTP routing	ALB HTTPS listener with HTTP targets	Backend traffic is plaintext inside the VPC
Encrypt client and backend traffic with HTTP-aware routing	ALB HTTPS listener with HTTPS target group	Certificates and TLS configuration are required at both layers
Let the application own the TLS session	NLB TCP listener with TLS handled by targets	No TLS termination or Layer 7 inspection at the NLB
Terminate TLS at the network load balancer	NLB TLS listener	NLB presents the frontend certificate and can forward to TCP or TLS targets
Keep the backend encrypted after NLB termination	NLB TLS listener with TLS target group	Requires separate backend TLS configuration
Use ACM-managed frontend certificates	ALB HTTPS or NLB TLS listener with ACM certificate	ACM certificate private keys generally cannot be installed on arbitrary targets
Preserve application-level control over client certificates or TLS behavior	NLB TLS pass-through	The application must handle certificate presentation and TLS operations

Common Exam Traps

• Assuming an HTTPS ALB encrypts everything: The ALB-to-target protocol is configured separately.
• Confusing TLS termination with pass-through: Termination means the load balancer decrypts traffic. Pass-through means the target decrypts it.
• Calling ALB re-encryption one continuous TLS connection: There are two TLS sessions with separate handshakes and certificates.
• Using an ALB for opaque encrypted traffic: An ALB is designed for Layer 7 protocols. Use an NLB when the load balancer must forward TLS without inspecting it.
• Assuming the target can use any ACM certificate: A target needs a certificate and private key available to its local TLS service. Non-exportable ACM certificate keys cannot be copied to an EC2 instance.
• Assuming a public certificate is always required on the backend: Backend certificate requirements depend on the target-side TLS implementation and trust model. A private or self-signed certificate may be suitable when the load balancer or application does not require public trust validation.
• Forgetting certificate renewal: Certificates on load balancers may be automatically renewed by ACM, while certificates installed directly on instances require their own renewal and deployment process.
• Ignoring security groups and target ports: TLS does not replace network controls. Permit only the listener and target ports required by the design.

Real-World Engineer Notes

• Treat the load balancer-to-target segment as a separate security boundary. VPC traffic is not automatically trusted merely because it is private.
• Use HTTPS target groups when traffic may traverse shared network infrastructure, when internal encryption is mandated, or when a defense-in-depth design is required.
• Centralize frontend certificate management in ACM where possible, and automate deployment of backend certificates through a certificate-management or configuration-management pipeline.
• Document which component owns TLS termination. This affects logging, client certificate handling, supported cipher suites, observability, and incident response.
• If the application needs the original client certificate or full control of the TLS handshake, TLS pass-through may be preferable to termination at the load balancer.
• Test certificate renewal and backend certificate rotation before production. A valid frontend certificate does not prove that the target-side TLS configuration is healthy.
• Use separate certificates where appropriate for the public endpoint and internal target service. They have different trust, renewal, and access requirements.

Quick Reference Summary

• ALB HTTPS → HTTP targets: encrypted client-to-ALB; plaintext ALB-to-target.
• ALB HTTPS → HTTPS targets: encrypted on both segments; TLS is terminated and re-established.
• NLB TCP → TLS targets: TLS pass-through; target owns the TLS session.
• NLB TLS → TCP targets: TLS terminates at the NLB; backend is plaintext.
• NLB TLS → TLS targets: TLS terminates at the NLB and is re-established to the target.
• ACM: preferred certificate store for supported AWS load balancer listeners.
• Target certificates: must be installed with accessible private keys and managed independently when TLS terminates on the target.

Flashcards

1. Q: What happens when an ALB HTTPS listener receives a request?

A: It terminates the client TLS session and opens a separate connection to the target.

1. Q: Does an HTTPS ALB automatically encrypt traffic to its targets?

A: No. The target group must use HTTPS if backend encryption is required.

1. Q: What is TLS re-encryption behind an ALB?

A: The ALB terminates client TLS and establishes a new TLS session with the target.

1. Q: What is NLB TLS pass-through?

A: The NLB forwards encrypted traffic without terminating TLS; the target presents the certificate and decrypts the connection.

1. Q: Which load balancer is appropriate for TLS pass-through?

A: A Network Load Balancer using a network-level listener such as TCP.

1. Q: What is the main limitation of TLS pass-through?

A: The load balancer cannot inspect HTTP content or perform Layer 7 routing on the encrypted traffic.

1. Q: Where are frontend load balancer certificates commonly stored?

A: AWS Certificate Manager.

1. Q: Why can’t a normal ACM-issued certificate simply be copied to an EC2 instance?

A: Its private key is not generally exportable for installation on arbitrary servers.

1. Q: What configuration encrypts both ALB traffic segments?

A: An HTTPS ALB listener with an HTTPS target group.

1. Q: What does an NLB TLS listener with TLS targets provide?

A: TLS termination at the NLB followed by a separate encrypted TLS connection to each target.

1. Q: Is a backend certificate necessarily required to be publicly trusted?

A: No. A private or self-signed certificate can be suitable depending on the backend trust and validation model.

1. Q: Are the client-to-load-balancer and load-balancer-to-target TLS sessions the same session?

A: No. They are separate connections with separate handshakes and certificate contexts.

Practice Questions

Question 1

A company hosts an HTTP application on EC2 instances behind an ALB. The public endpoint must use HTTPS, but the security policy does not require encryption inside the VPC. Which design is the simplest appropriate solution?

A. TCP listener on an NLB with certificates installed on every instance
B. HTTPS listener on the ALB with an HTTP target group
C. HTTPS listener on the ALB with an HTTPS target group and certificates on every instance
D. TCP listener on the ALB with ACM certificates

Correct answer: B

The ALB can terminate frontend TLS using an ACM certificate and forward requests over HTTP to the targets. An ALB is the appropriate choice when HTTP-aware routing is required and backend encryption is not mandated.

Question 2

A regulated workload requires encryption from clients through the load balancer to EC2 targets. The architecture must retain ALB host-based and path-based routing. Which configuration meets the requirement?

A. ALB HTTPS listener with an HTTP target group
B. ALB HTTP listener with an HTTPS target group
C. ALB HTTPS listener with an HTTPS target group
D. NLB TCP listener with an HTTP target group

Correct answer: C

The frontend HTTPS listener encrypts client traffic, and the HTTPS target group encrypts the second connection to the instances. The ALB still provides Layer 7 routing.

Question 3

An application must terminate TLS itself because it uses application-managed client certificates. The load balancer must forward the encrypted session without inspecting HTTP content. Which design is most appropriate?

A. ALB HTTPS listener with HTTP targets
B. ALB HTTPS listener with HTTPS targets
C. NLB TCP listener with TLS handled by the targets
D. NLB TLS listener with HTTP targets

Correct answer: C

NLB TCP pass-through allows the target to own the TLS session and handle client certificates. The NLB does not decrypt or perform Layer 7 inspection.

Question 4

An organization wants an NLB to use an ACM certificate for public client connections while also requiring encryption from the NLB to the targets. Which configuration should be used?

A. NLB TLS listener with a TLS target group
B. NLB TCP listener with an HTTP target group
C. NLB UDP listener with a TLS target group
D. ALB HTTPS listener with a TCP target group

Correct answer: A

The TLS listener uses the ACM certificate at the NLB, and the TLS target group creates a separate encrypted connection to each target.

Question 5

An engineer proposes installing an ACM-issued public certificate directly on an EC2 instance behind an ALB. What is the primary issue with this plan?

A. ACM certificates can only be used with NLBs
B. ALBs cannot forward HTTPS traffic to targets
C. The private key for a standard ACM-issued certificate is generally not exportable for installation on the instance
D. HTTPS target groups require a certificate issued by the same CA as the ALB certificate

Correct answer: C

A target that terminates TLS needs access to its certificate and private key. Standard ACM-issued certificate private keys are not generally exportable, so the instance should use a separately managed certificate suitable for installation on the host.