SSL/TLS termination in AWS - Commands & Configuration

Introduction

SSL/TLS termination means stopping the secure connection at a point before the traffic reaches your app. This helps your app handle normal traffic without worrying about encryption, making things faster and simpler.

When you want to secure your website with HTTPS but keep your app servers simple.

When you use a load balancer to share traffic among many servers and want to manage SSL certificates in one place.

When you want to reduce the work your app servers do by handling encryption outside them.

When you want to easily update or change SSL certificates without touching your app servers.

When you want to monitor and control secure traffic centrally before it reaches your backend.

Config File - main.tf

main.tf

provider "aws" {
  region = "us-east-1"
}

resource "aws_lb" "example" {
  name               = "example-lb"
  internal           = false
  load_balancer_type = "application"
  subnets            = ["subnet-0123456789abcdef0", "subnet-0fedcba9876543210"]
}

resource "aws_lb_target_group" "example_tg" {
  name     = "example-tg"
  port     = 80
  protocol = "HTTP"
  vpc_id   = "vpc-0123456789abcdef0"
}

resource "aws_lb_listener" "https_listener" {
  load_balancer_arn = aws_lb.example.arn
  port              = 443
  protocol          = "HTTPS"

  ssl_policy        = "ELBSecurityPolicy-2016-08"
  certificate_arn   = "arn:aws:acm:us-east-1:123456789012:certificate/abcd1234-5678-90ab-cdef-EXAMPLE11111"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.example_tg.arn
  }
}

This Terraform file creates an AWS Application Load Balancer (ALB) that listens on port 443 for HTTPS traffic.

The aws_lb resource sets up the load balancer.

The aws_lb_target_group defines where the traffic will be sent after SSL termination, here on port 80 using HTTP.

The aws_lb_listener listens on HTTPS port 443, uses an SSL certificate from AWS Certificate Manager (ACM), and forwards decrypted traffic to the target group.

Commands

This command prepares Terraform to work with AWS by downloading necessary plugins and setting up the environment.

Terminal

terraform init

Expected Output

Initializing the backend...



Initializing provider plugins...

- Finding latest version of hashicorp/aws...

- Installing hashicorp/aws v4.0.0...

- Installed hashicorp/aws v4.0.0 (signed by HashiCorp)



Terraform has been successfully initialized!

This command creates the AWS resources defined in the Terraform file, including the load balancer with SSL termination.

Terminal

terraform apply -auto-approve

Expected Output

aws_lb.example: Creating...

aws_lb_target_group.example_tg: Creating...

aws_lb_target_group.example_tg: Creation complete after 2s [id=arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/example-tg/abcdef1234567890]

aws_lb.example: Creation complete after 10s [id=arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/example-lb/1234567890abcdef]

aws_lb_listener.https_listener: Creating...

aws_lb_listener.https_listener: Creation complete after 3s [id=arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/example-lb/1234567890abcdef/abcdef1234567890]



Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

→

-auto-approve - Automatically approve the plan without asking for confirmation

This command checks the listeners on the load balancer to confirm the HTTPS listener with SSL termination is active.

Terminal

aws elbv2 describe-listeners --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/example-lb/1234567890abcdef

Expected Output

{

    "Listeners": [

        {

            "ListenerArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/example-lb/1234567890abcdef/abcdef1234567890",

            "LoadBalancerArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/example-lb/1234567890abcdef",

            "Port": 443,

            "Protocol": "HTTPS",

            "Certificates": [

                {

                    "CertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/abcd1234-5678-90ab-cdef-EXAMPLE11111"

                }

            ],

            "DefaultActions": [

                {

                    "Type": "forward",

                    "TargetGroupArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/example-tg/abcdef1234567890"

                }

            ]

        }

    ]

}

→

--load-balancer-arn - Specifies which load balancer to describe

Key Concept

If you remember nothing else from this pattern, remember: SSL/TLS termination moves encryption work from your app servers to a central place like a load balancer to simplify and speed up your backend.

Common Mistakes

Not attaching a valid SSL certificate to the load balancer listener.

Without a valid certificate, the load balancer cannot accept HTTPS traffic, causing connection errors.

Always request or import a valid SSL certificate in AWS Certificate Manager and reference its ARN in the listener configuration.

Configuring the target group to use HTTPS instead of HTTP after SSL termination.

This causes double encryption which is unnecessary and can cause connection failures if backend servers are not set up for HTTPS.

Set the target group protocol to HTTP so decrypted traffic is forwarded to backend servers.

Not opening port 443 in the load balancer security group.

Traffic on HTTPS port will be blocked, making the service unreachable over HTTPS.

Ensure the security group attached to the load balancer allows inbound traffic on port 443.

Summary

Use Terraform to create an AWS Application Load Balancer with an HTTPS listener for SSL termination.

Attach a valid SSL certificate from AWS Certificate Manager to the listener to enable secure connections.

Forward decrypted HTTP traffic from the load balancer to backend servers using a target group.

Verify the listener and certificate setup using AWS CLI commands.

Practice

1. What is the main purpose of SSL/TLS termination on an AWS load balancer?

easy

A. To store SSL certificates on backend servers

B. To decrypt incoming HTTPS traffic before sending it to backend servers

C. To encrypt traffic between backend servers

D. To disable HTTPS on the load balancer

Solution

1. Step 1: Understand SSL/TLS termination role

   SSL/TLS termination means the load balancer decrypts HTTPS traffic so backend servers receive plain HTTP.

2. Step 2: Identify where decryption happens

   The load balancer handles the SSL certificates and decrypts traffic, simplifying backend server setup.

3. Final Answer:

   To decrypt incoming HTTPS traffic before sending it to backend servers -> Option B

4. Quick Check:

   SSL/TLS termination = decrypt at load balancer [OK]

Hint: SSL termination means decrypt at load balancer, not backend [OK]

Common Mistakes:

• Thinking backend servers handle SSL decryption
• Confusing encryption with decryption location
• Assuming SSL certificates must be on backend servers

2. Which AWS load balancer listener configuration correctly enables SSL/TLS termination?

easy

A. Listener protocol HTTP on port 80 with SSL certificate attached

B. Listener protocol TCP on port 443 without SSL certificate

C. Listener protocol HTTPS on port 443 with SSL certificate attached

D. Listener protocol HTTPS on port 80 without SSL certificate

Solution

1. Step 1: Identify correct protocol and port for SSL termination

   HTTPS protocol on port 443 is standard for SSL/TLS termination.

2. Step 2: Confirm SSL certificate attachment

   SSL certificate must be attached to the HTTPS listener to enable termination.

3. Final Answer:

   Listener protocol HTTPS on port 443 with SSL certificate attached -> Option C

4. Quick Check:

   HTTPS + port 443 + cert = SSL termination [OK]

Hint: SSL termination needs HTTPS listener on port 443 with cert [OK]

Common Mistakes:

• Using HTTP protocol with SSL certificate
• Using wrong port for HTTPS
• Not attaching SSL certificate to listener

3. Given this AWS Application Load Balancer listener configuration:
Listener: HTTPS on port 443 with SSL certificate
What happens if a client sends an HTTP request to port 80?

medium

A. The request is forwarded to backend servers without encryption

B. The request is accepted as plain HTTP without encryption

C. The request is automatically redirected to HTTPS on port 443

D. The request is rejected with a connection error

Solution

1. Step 1: Check listener configuration for port 80

   No listener is defined on port 80, so the load balancer does not accept HTTP requests.

2. Step 2: Understand behavior without HTTP listener

   Without an HTTP listener, requests to port 80 fail with connection errors.

3. Final Answer:

   The request is rejected with a connection error -> Option D

4. Quick Check:

   No HTTP listener = connection error on port 80 [OK]

Hint: No HTTP listener means HTTP requests fail, no redirect [OK]

Common Mistakes:

• Assuming automatic HTTP to HTTPS redirect without listener
• Thinking HTTP requests are accepted without encryption
• Confusing backend server behavior with load balancer

4. You configured an AWS load balancer with an HTTPS listener on port 443 and attached a valid SSL certificate. However, clients report SSL errors when connecting. What is the most likely cause?

medium

A. The SSL certificate is expired or not trusted by clients

B. The load balancer listener is set to HTTP instead of HTTPS

C. Backend servers do not support HTTPS

D. The load balancer is missing a target group

Solution

1. Step 1: Verify SSL certificate validity

   SSL errors often occur if the certificate is expired or not trusted by client browsers.

2. Step 2: Check listener and backend setup

   Listener is HTTPS with certificate attached, so listener config is correct; backend HTTPS support is optional after termination.

3. Final Answer:

   The SSL certificate is expired or not trusted by clients -> Option A

4. Quick Check:

   SSL errors usually mean bad or expired cert [OK]

Hint: SSL errors usually mean certificate issues [OK]

Common Mistakes:

• Assuming backend HTTPS affects client SSL errors
• Confusing listener protocol with certificate validity
• Ignoring certificate expiration or trust chain

5. You want to ensure all HTTP traffic to your AWS Application Load Balancer is securely redirected to HTTPS. Which configuration achieves this best?

hard

A. Create an HTTP listener on port 80 that redirects all requests to HTTPS on port 443

B. Create an HTTPS listener on port 443 and disable HTTP listener

C. Configure backend servers to redirect HTTP to HTTPS

D. Attach SSL certificates to backend servers only

Solution

1. Step 1: Understand how to redirect HTTP to HTTPS at load balancer

   Creating an HTTP listener on port 80 that redirects to HTTPS ensures all HTTP requests become secure.

2. Step 2: Evaluate other options

   Disabling HTTP listener blocks HTTP requests; backend redirects add latency and complexity; attaching certs only to backend does not redirect.

3. Final Answer:

   Create an HTTP listener on port 80 that redirects all requests to HTTPS on port 443 -> Option A

4. Quick Check:

   HTTP listener with redirect = secure all traffic [OK]

Hint: Use HTTP listener redirect to HTTPS for secure traffic [OK]

Common Mistakes:

• Disabling HTTP listener without redirect
• Relying on backend servers for redirects
• Not attaching SSL cert to load balancer listener