SSL/TLS termination in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the protocol for SSL termination on the load balancer.

AWS

LoadBalancerProtocol: [1]

Drag options to blanks, or click blank then click option'

AHTTPS

BHTTP

CTCP

DUDP

Attempts:

3 left

💡 Hint

Common Mistakes

Using HTTP instead of HTTPS for SSL termination.

Choosing TCP or UDP which do not handle SSL termination directly.

The load balancer must use HTTPS protocol to handle SSL/TLS termination.

2fill in blank

medium

Complete the code to specify the certificate ARN for SSL termination in AWS Elastic Load Balancer.

AWS

CertificateArn: [1]

Drag options to blanks, or click blank then click option'

Aarn:aws:iam::account:user/username

Barn:aws:acm:region:account:certificate/12345678

Carn:aws:ec2:region:account:instance/i-12345678

Darn:aws:s3:::mybucket/certificate.pem

Attempts:

3 left

💡 Hint

Common Mistakes

Using an ARN from S3 or EC2 instead of ACM.

Using an IAM user ARN instead of a certificate ARN.

The certificate ARN must be from AWS Certificate Manager (ACM) to enable SSL termination.

3fill in blank

hard

Fix the error in the listener configuration to enable SSL termination on port 443.

AWS

Listener: {
  Protocol: [1],
  Port: 443
}

Drag options to blanks, or click blank then click option'

ATCP

BHTTP

CHTTPS

DUDP

Attempts:

3 left

💡 Hint

Common Mistakes

Using HTTP protocol on port 443.

Using TCP or UDP which do not handle SSL termination.

The listener protocol must be HTTPS to handle SSL termination on port 443.

4fill in blank

hard

Fill both blanks to configure the target group protocol and port for decrypted traffic after SSL termination.

AWS

TargetGroup: {
  Protocol: [1],
  Port: [2]
}

Drag options to blanks, or click blank then click option'

AHTTP

BHTTPS

C80

D443

Attempts:

3 left

💡 Hint

Common Mistakes

Using HTTPS and port 443 for target group when SSL is terminated at the load balancer.

Mixing protocols and ports incorrectly.

After SSL termination, traffic to targets is usually unencrypted HTTP on port 80.

5fill in blank

hard

Fill all three blanks to complete the AWS CLI command for creating a listener with SSL termination.

AWS

aws elbv2 create-listener --load-balancer-arn [1] --protocol [2] --port [3] --certificates CertificateArn=arn:aws:acm:region:account:certificate/12345678 --default-actions Type=forward,TargetGroupArn=targetgroup-arn

Drag options to blanks, or click blank then click option'

Aarn:aws:elasticloadbalancing:region:account:loadbalancer/app/my-loadbalancer/50dc6c495c0c9188

BHTTPS

C443

DHTTP

Attempts:

3 left

💡 Hint

Common Mistakes

Using HTTP protocol or port 80 for SSL termination listener.

Using incorrect ARN formats.

The command requires the load balancer ARN, HTTPS protocol, and port 443 for SSL termination listener.

Practice

1. What is the main purpose of SSL/TLS termination on an AWS load balancer?

easy

A. To store SSL certificates on backend servers

B. To decrypt incoming HTTPS traffic before sending it to backend servers

C. To encrypt traffic between backend servers

D. To disable HTTPS on the load balancer

Solution

1. Step 1: Understand SSL/TLS termination role

   SSL/TLS termination means the load balancer decrypts HTTPS traffic so backend servers receive plain HTTP.

2. Step 2: Identify where decryption happens

   The load balancer handles the SSL certificates and decrypts traffic, simplifying backend server setup.

3. Final Answer:

   To decrypt incoming HTTPS traffic before sending it to backend servers -> Option B

4. Quick Check:

   SSL/TLS termination = decrypt at load balancer [OK]

Hint: SSL termination means decrypt at load balancer, not backend [OK]

Common Mistakes:

• Thinking backend servers handle SSL decryption
• Confusing encryption with decryption location
• Assuming SSL certificates must be on backend servers

2. Which AWS load balancer listener configuration correctly enables SSL/TLS termination?

easy

A. Listener protocol HTTP on port 80 with SSL certificate attached

B. Listener protocol TCP on port 443 without SSL certificate

C. Listener protocol HTTPS on port 443 with SSL certificate attached

D. Listener protocol HTTPS on port 80 without SSL certificate

Solution

1. Step 1: Identify correct protocol and port for SSL termination

   HTTPS protocol on port 443 is standard for SSL/TLS termination.

2. Step 2: Confirm SSL certificate attachment

   SSL certificate must be attached to the HTTPS listener to enable termination.

3. Final Answer:

   Listener protocol HTTPS on port 443 with SSL certificate attached -> Option C

4. Quick Check:

   HTTPS + port 443 + cert = SSL termination [OK]

Hint: SSL termination needs HTTPS listener on port 443 with cert [OK]

Common Mistakes:

• Using HTTP protocol with SSL certificate
• Using wrong port for HTTPS
• Not attaching SSL certificate to listener

3. Given this AWS Application Load Balancer listener configuration:
Listener: HTTPS on port 443 with SSL certificate
What happens if a client sends an HTTP request to port 80?

medium

A. The request is forwarded to backend servers without encryption

B. The request is accepted as plain HTTP without encryption

C. The request is automatically redirected to HTTPS on port 443

D. The request is rejected with a connection error

Solution

1. Step 1: Check listener configuration for port 80

   No listener is defined on port 80, so the load balancer does not accept HTTP requests.

2. Step 2: Understand behavior without HTTP listener

   Without an HTTP listener, requests to port 80 fail with connection errors.

3. Final Answer:

   The request is rejected with a connection error -> Option D

4. Quick Check:

   No HTTP listener = connection error on port 80 [OK]

Hint: No HTTP listener means HTTP requests fail, no redirect [OK]

Common Mistakes:

• Assuming automatic HTTP to HTTPS redirect without listener
• Thinking HTTP requests are accepted without encryption
• Confusing backend server behavior with load balancer

4. You configured an AWS load balancer with an HTTPS listener on port 443 and attached a valid SSL certificate. However, clients report SSL errors when connecting. What is the most likely cause?

medium

A. The SSL certificate is expired or not trusted by clients

B. The load balancer listener is set to HTTP instead of HTTPS

C. Backend servers do not support HTTPS

D. The load balancer is missing a target group

Solution

1. Step 1: Verify SSL certificate validity

   SSL errors often occur if the certificate is expired or not trusted by client browsers.

2. Step 2: Check listener and backend setup

   Listener is HTTPS with certificate attached, so listener config is correct; backend HTTPS support is optional after termination.

3. Final Answer:

   The SSL certificate is expired or not trusted by clients -> Option A

4. Quick Check:

   SSL errors usually mean bad or expired cert [OK]

Hint: SSL errors usually mean certificate issues [OK]

Common Mistakes:

• Assuming backend HTTPS affects client SSL errors
• Confusing listener protocol with certificate validity
• Ignoring certificate expiration or trust chain

5. You want to ensure all HTTP traffic to your AWS Application Load Balancer is securely redirected to HTTPS. Which configuration achieves this best?

hard

A. Create an HTTP listener on port 80 that redirects all requests to HTTPS on port 443

B. Create an HTTPS listener on port 443 and disable HTTP listener

C. Configure backend servers to redirect HTTP to HTTPS

D. Attach SSL certificates to backend servers only

Solution

1. Step 1: Understand how to redirect HTTP to HTTPS at load balancer

   Creating an HTTP listener on port 80 that redirects to HTTPS ensures all HTTP requests become secure.

2. Step 2: Evaluate other options

   Disabling HTTP listener blocks HTTP requests; backend redirects add latency and complexity; attaching certs only to backend does not redirect.

3. Final Answer:

   Create an HTTP listener on port 80 that redirects all requests to HTTPS on port 443 -> Option A

4. Quick Check:

   HTTP listener with redirect = secure all traffic [OK]

Hint: Use HTTP listener redirect to HTTPS for secure traffic [OK]

Common Mistakes:

• Disabling HTTP listener without redirect
• Relying on backend servers for redirects
• Not attaching SSL cert to load balancer listener