--- title: "Add an SSL certificate" description: "Serve HTTPS from an E2E Application Load Balancer with your own SSL certificate, redirect HTTP to HTTPS, and renew or replace the certificate." content_type: "how-to" product: "load-balancer" platform: "MyAccount" url: "/myaccount/load-balancer/how-to/add-an-ssl-certificate/" topic: ["route-traffic"] relationships: {"requires":["/myaccount/load-balancer/how-to/create-an-application-load-balancer/"]} --- # Add an SSL certificate An Application Load Balancer (ALB) can serve your site over HTTPS with your own SSL certificate. The load balancer handles the encryption with your users, so you manage the certificate in one place rather than on every server. HTTPS on the load balancer supports HTTP/2 and HTTP/1.1. You choose the certificate when you create the ALB, or later on its **Info** tab. The same steps renew it. On a Network Load Balancer (NLB), the certificate lives on your servers instead, since an NLB forwards encrypted traffic as it is. ## Before you begin - You have an ALB, or you are creating one. See [Create an Application Load Balancer](/myaccount/load-balancer/how-to/create-an-application-load-balancer/). - You have the certificate, its private key, and the certificate chain. A certificate from any certificate authority, free or paid, is imported the same way. - For a load balancer you already have, it has left **Powered off**, **Creating**, **Deploying**, or **Upgrading**. - Your role in the project has the update permission for **Load Balancers**. ## Import the certificate The load balancer's **SSL** list shows only the certificates imported in MyAccount's **SSL Certificates** in the same project. A certificate you bought from E2E appears there once you import it with its private key. An imported certificate belongs to the project, whatever region you import it in. You can choose the same certificate for a load balancer in Delhi and for one in Chennai. A certificate you buy in MyAccount is issued for the certificate signing request (CSR) you supply. Its private key is the one you created with that CSR on your own machine, and MyAccount never has it. Import that key with the issued certificate. 1. Open **Manage SSL Certificates**. When you create a load balancer, follow the **here** link in the line under **SSL**. On the **Info** tab's edit form, click **Buy or Import SSL Certificate** beside **SSL**. Either way, **Manage SSL Certificates** opens in a new tab. 2. Click **Import SSL Certificate**. 3. Enter a **Name** for the certificate. 4. Fill in **SSL Certificate**, **SSL Certificate private key**, and **SSL Certificate chain**. Paste each one, or click **Load from file** to load it from a file. All three are required. 5. Click **Import Certificate**. **SSL certificate successfully imported.** confirms it. 6. Back on the load balancer's form, reload the **SSL** list, and your certificate appears. The import checks that each file is in the right format. Check for yourself that the key and the certificate belong together before you import them: ```bash openssl x509 -noout -modulus -in | openssl md5 openssl rsa -noout -modulus -in | openssl md5 ``` `` is the certificate and `` the private key. The two lines of output match when they belong together. This check is for RSA keys. ## Choose the certificate on the load balancer For a new load balancer, you do this on **Details**; see [Fill in the details](/myaccount/load-balancer/how-to/create-an-application-load-balancer/#fill-in-the-details). For a load balancer you already have: 1. In MyAccount, under **Compute**, click **Load Balancers**, click the load balancer, and open its **Info** tab. 2. Click **Edit** beside **Frontend Protocol** or **SSL**. The edit form opens. 3. Under **Frontend Protocol**, choose **HTTPS** to serve on port 443 only, or **Both (HTTP and HTTPS)** to serve on ports 80 and 443. 4. Under **SSL**, choose your certificate. 5. (Optional) With **Both (HTTP and HTTPS)**, tick **HTTP Redirect**; see [Redirect HTTP to HTTPS](#redirect-http-to-https). 6. Click **Submit**. The change takes about 5 to 10 minutes, and the load balancer reads **Deploying** until the change is applied. If it stays in **Deploying** far longer than that, see [The load balancer stays on Creating, Deploying, or Upgrading](/myaccount/load-balancer/troubleshooting/load-balancer/#the-load-balancer-stays-on-creating-deploying-or-upgrading). Each load balancer takes a single certificate. To serve several domains, use one certificate that covers them all, such as a wildcard or multi-domain certificate. The load balancer's security group must allow port 443, and port 80 for **Both (HTTP and HTTPS)**, from your users. See [Manage a load balancer's network and security groups](/myaccount/load-balancer/how-to/manage-network-and-security-groups/). ## Redirect HTTP to HTTPS To redirect plain HTTP to HTTPS, choose **Both (HTTP and HTTPS)** and tick **HTTP Redirect**; the redirect works only with **Both (HTTP and HTTPS)**. The load balancer then answers each plain HTTP request on port 80 with a redirect to the same address over HTTPS. It applies to every path, and ACL rules do not change it. When you create the load balancer, tick **HTTP Redirect** on **Details**. For a load balancer you already have: 1. On the **Info** tab, click **Edit** beside **Frontend Protocol**. 2. Check that **Frontend Protocol** is **Both (HTTP and HTTPS)**. 3. Tick **HTTP Redirect**, and click **Submit**. On the **Info** tab, **HTTP Redirect** under **Peak Performance Features** reads **True** once it is on, and **False** otherwise. ## Renew or replace the certificate A renewed certificate takes effect once you choose it again: 1. Import the renewed certificate, with its private key and chain, as a new certificate. See [Import the certificate](#import-the-certificate). 2. On the load balancer's **Info** tab, click **Edit** beside **SSL**, choose the renewed certificate, and click **Submit**. 3. Wait until the load balancer reads **Running** again. Delete the old certificate from **SSL Certificates** once no load balancer uses it. While one uses it, the delete is refused with **SSL is currently enabled on the Load Balancer. It cannot be deleted.** ## Encrypt traffic to your servers The certificate encrypts traffic between your users and the load balancer. To keep traffic encrypted from the load balancer to your servers too, set the backend group's **Backend Protocol** to **HTTPS**, with your servers serving HTTPS on the server port. See [Choose the backend protocol (ALB)](/myaccount/load-balancer/how-to/manage-backend-groups/#choose-the-backend-protocol-alb). ## Check that HTTPS works To test HTTPS by name, point your domain's A record at the load balancer's **Public IP** first. When the load balancer reads **Running**, request your site over HTTPS, where `` is a name the certificate covers: ```bash curl -I https:/// ``` The first line shows the status your site answered with, such as `HTTP/2 200`. To see the certificate itself, open `https:///` in a browser, and view the site's certificate there. Use the domain name, since the certificate covers the names on it rather than the load balancer's IP. If your certificate is missing from the **SSL** list, see [My certificate is missing from the SSL list](/myaccount/load-balancer/troubleshooting/load-balancer/#my-certificate-is-missing-from-the-ssl-list).