SSL/TLS termination in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does SSL/TLS termination affect backend servers?

When SSL/TLS termination is configured on a load balancer, what is the effect on the backend servers?

A Backend servers receive encrypted traffic and must decrypt it themselves.

B Backend servers receive unencrypted traffic because the load balancer decrypts it first.

C Backend servers do not receive any traffic; the load balancer handles all requests internally.

D Backend servers receive traffic encrypted with a different certificate than the client.

💡 Hint

Think about where the encryption ends when SSL/TLS termination is used.

SSL/TLS termination means the load balancer decrypts the traffic before sending it to backend servers, so backend servers get unencrypted traffic.

❓ Architecture

intermediate

Choosing SSL/TLS termination location for a web app

You have a web application hosted on AWS behind an Application Load Balancer (ALB). You want to secure client connections with HTTPS. Which option correctly describes where SSL/TLS termination should be configured for best practice?

A Do not use SSL/TLS termination; let clients connect over HTTP directly to backend instances.

B Configure SSL/TLS termination only on backend instances; ALB forwards encrypted traffic.

C Configure SSL/TLS termination on both ALB and backend instances simultaneously.

D Configure SSL/TLS termination on the ALB so it handles HTTPS and forwards HTTP to backend instances.

💡 Hint

Consider where it is easier to manage certificates and reduce backend load.

Terminating SSL/TLS at the ALB centralizes certificate management and reduces CPU load on backend servers.

❓ security

advanced

Security risk of SSL/TLS termination at load balancer

What is a potential security risk when SSL/TLS termination is done at the load balancer and traffic between the load balancer and backend servers is unencrypted?

A SSL/TLS termination at load balancer causes data loss during transmission.

B Clients will see certificate errors because backend servers do not have certificates.

C Backend servers can be exposed to man-in-the-middle attacks on internal network if it is not secure.

D Load balancer cannot decrypt traffic, causing connection failures.

💡 Hint

Think about what happens to data after decryption at the load balancer.

After SSL/TLS termination, traffic between load balancer and backend is unencrypted. If the internal network is not secure, attackers could intercept this traffic.

❓ Configuration

advanced

AWS CLI command to create SSL/TLS listener on ALB

Which AWS CLI command correctly creates an HTTPS listener on an existing Application Load Balancer with SSL/TLS termination using a specified certificate ARN?

A aws elbv2 create-listener --load-balancer-arn <alb-arn> --protocol HTTPS --port 443 --certificates CertificateArn=<cert-arn> --default-actions Type=forward,TargetGroupArn=<tg-arn>

B aws elbv2 create-listener --load-balancer-arn <alb-arn> --protocol HTTP --port 80 --certificates CertificateArn=<cert-arn> --default-actions Type=forward,TargetGroupArn=<tg-arn>

C aws elbv2 create-listener --load-balancer-arn <alb-arn> --protocol HTTPS --port 80 --certificates CertificateArn=<cert-arn> --default-actions Type=forward,TargetGroupArn=<tg-arn>

D aws elbv2 create-listener --load-balancer-arn <alb-arn> --protocol TCP --port 443 --certificates CertificateArn=<cert-arn> --default-actions Type=forward,TargetGroupArn=<tg-arn>

💡 Hint

Remember HTTPS uses port 443 and the protocol must be HTTPS for SSL termination.

The correct command uses protocol HTTPS on port 443 with the certificate ARN specified to enable SSL/TLS termination on the ALB listener.

✅ Best Practice

expert

Optimal SSL/TLS termination strategy for multi-tier AWS app

You have a multi-tier web application in AWS with a public Application Load Balancer (ALB) in front, an internal Network Load Balancer (NLB) for backend services, and EC2 instances behind the NLB. You want to ensure end-to-end encryption with minimal latency and simplified certificate management. Which SSL/TLS termination strategy is best?

A Terminate SSL/TLS at the ALB, re-encrypt traffic with HTTPS to the NLB, and terminate SSL/TLS at backend EC2 instances.

B Terminate SSL/TLS at the ALB and NLB, forwarding unencrypted traffic to backend EC2 instances.

C Terminate SSL/TLS only at the NLB, forwarding encrypted traffic from ALB to NLB and backend instances.

D Terminate SSL/TLS at the ALB, use HTTP between ALB and NLB, and terminate SSL/TLS again at backend EC2 instances.

💡 Hint

Consider how to keep encryption end-to-end while managing certificates efficiently.

Terminating SSL/TLS at ALB and re-encrypting to NLB, then terminating again at backend ensures encryption on every segment. It balances security and certificate management.

Practice

1. What is the main purpose of SSL/TLS termination on an AWS load balancer?

easy

A. To store SSL certificates on backend servers

B. To decrypt incoming HTTPS traffic before sending it to backend servers

C. To encrypt traffic between backend servers

D. To disable HTTPS on the load balancer

Solution

1. Step 1: Understand SSL/TLS termination role

   SSL/TLS termination means the load balancer decrypts HTTPS traffic so backend servers receive plain HTTP.

2. Step 2: Identify where decryption happens

   The load balancer handles the SSL certificates and decrypts traffic, simplifying backend server setup.

3. Final Answer:

   To decrypt incoming HTTPS traffic before sending it to backend servers -> Option B

4. Quick Check:

   SSL/TLS termination = decrypt at load balancer [OK]

Hint: SSL termination means decrypt at load balancer, not backend [OK]

Common Mistakes:

• Thinking backend servers handle SSL decryption
• Confusing encryption with decryption location
• Assuming SSL certificates must be on backend servers

2. Which AWS load balancer listener configuration correctly enables SSL/TLS termination?

easy

A. Listener protocol HTTP on port 80 with SSL certificate attached

B. Listener protocol TCP on port 443 without SSL certificate

C. Listener protocol HTTPS on port 443 with SSL certificate attached

D. Listener protocol HTTPS on port 80 without SSL certificate

Solution

1. Step 1: Identify correct protocol and port for SSL termination

   HTTPS protocol on port 443 is standard for SSL/TLS termination.

2. Step 2: Confirm SSL certificate attachment

   SSL certificate must be attached to the HTTPS listener to enable termination.

3. Final Answer:

   Listener protocol HTTPS on port 443 with SSL certificate attached -> Option C

4. Quick Check:

   HTTPS + port 443 + cert = SSL termination [OK]

Hint: SSL termination needs HTTPS listener on port 443 with cert [OK]

Common Mistakes:

• Using HTTP protocol with SSL certificate
• Using wrong port for HTTPS
• Not attaching SSL certificate to listener

3. Given this AWS Application Load Balancer listener configuration:
Listener: HTTPS on port 443 with SSL certificate
What happens if a client sends an HTTP request to port 80?

medium

A. The request is forwarded to backend servers without encryption

B. The request is accepted as plain HTTP without encryption

C. The request is automatically redirected to HTTPS on port 443

D. The request is rejected with a connection error

Solution

1. Step 1: Check listener configuration for port 80

   No listener is defined on port 80, so the load balancer does not accept HTTP requests.

2. Step 2: Understand behavior without HTTP listener

   Without an HTTP listener, requests to port 80 fail with connection errors.

3. Final Answer:

   The request is rejected with a connection error -> Option D

4. Quick Check:

   No HTTP listener = connection error on port 80 [OK]

Hint: No HTTP listener means HTTP requests fail, no redirect [OK]

Common Mistakes:

• Assuming automatic HTTP to HTTPS redirect without listener
• Thinking HTTP requests are accepted without encryption
• Confusing backend server behavior with load balancer

4. You configured an AWS load balancer with an HTTPS listener on port 443 and attached a valid SSL certificate. However, clients report SSL errors when connecting. What is the most likely cause?

medium

A. The SSL certificate is expired or not trusted by clients

B. The load balancer listener is set to HTTP instead of HTTPS

C. Backend servers do not support HTTPS

D. The load balancer is missing a target group

Solution

1. Step 1: Verify SSL certificate validity

   SSL errors often occur if the certificate is expired or not trusted by client browsers.

2. Step 2: Check listener and backend setup

   Listener is HTTPS with certificate attached, so listener config is correct; backend HTTPS support is optional after termination.

3. Final Answer:

   The SSL certificate is expired or not trusted by clients -> Option A

4. Quick Check:

   SSL errors usually mean bad or expired cert [OK]

Hint: SSL errors usually mean certificate issues [OK]

Common Mistakes:

• Assuming backend HTTPS affects client SSL errors
• Confusing listener protocol with certificate validity
• Ignoring certificate expiration or trust chain

5. You want to ensure all HTTP traffic to your AWS Application Load Balancer is securely redirected to HTTPS. Which configuration achieves this best?

hard

A. Create an HTTP listener on port 80 that redirects all requests to HTTPS on port 443

B. Create an HTTPS listener on port 443 and disable HTTP listener

C. Configure backend servers to redirect HTTP to HTTPS

D. Attach SSL certificates to backend servers only

Solution

1. Step 1: Understand how to redirect HTTP to HTTPS at load balancer

   Creating an HTTP listener on port 80 that redirects to HTTPS ensures all HTTP requests become secure.

2. Step 2: Evaluate other options

   Disabling HTTP listener blocks HTTP requests; backend redirects add latency and complexity; attaching certs only to backend does not redirect.

3. Final Answer:

   Create an HTTP listener on port 80 that redirects all requests to HTTPS on port 443 -> Option A

4. Quick Check:

   HTTP listener with redirect = secure all traffic [OK]

Hint: Use HTTP listener redirect to HTTPS for secure traffic [OK]

Common Mistakes:

• Disabling HTTP listener without redirect
• Relying on backend servers for redirects
• Not attaching SSL cert to load balancer listener