Add an SSL certificate

An Application Load Balancer (ALB) can serve your site over HTTPS with your own SSL certificate. The load balancer handles the encryption with your users, so you manage the certificate in one place rather than on every server. HTTPS on the load balancer supports HTTP/2 and HTTP/1.1.

You choose the certificate when you create the ALB, or later on its Info tab. The same steps renew it. On a Network Load Balancer (NLB), the certificate lives on your servers instead, since an NLB forwards encrypted traffic as it is.

Before you begin

• You have an ALB, or you are creating one. See Create an Application Load Balancer.
• You have the certificate, its private key, and the certificate chain. A certificate from any certificate authority, free or paid, is imported the same way.
• For a load balancer you already have, it has left Powered off, Creating, Deploying, or Upgrading.
• Your role in the project has the update permission for Load Balancers.

Import the certificate

The load balancer’s SSL list shows only the certificates imported in MyAccount’s SSL Certificates in the same project. A certificate you bought from E2E appears there once you import it with its private key.

An imported certificate belongs to the project, whatever region you import it in. You can choose the same certificate for a load balancer in Delhi and for one in Chennai.

A certificate you buy in MyAccount is issued for the certificate signing request (CSR) you supply. Its private key is the one you created with that CSR on your own machine, and MyAccount never has it. Import that key with the issued certificate.

1. Open Manage SSL Certificates. When you create a load balancer, follow the here link in the line under SSL. On the Info tab’s edit form, click Buy or Import SSL Certificate beside SSL. Either way, Manage SSL Certificates opens in a new tab.
2. Click Import SSL Certificate.
3. Enter a Name for the certificate.
4. Fill in SSL Certificate, SSL Certificate private key, and SSL Certificate chain. Paste each one, or click Load from file to load it from a file. All three are required.
5. Click Import Certificate. SSL certificate successfully imported. confirms it.
6. Back on the load balancer’s form, reload the SSL list, and your certificate appears.

The import checks that each file is in the right format. Check for yourself that the key and the certificate belong together before you import them:

openssl x509 -noout -modulus -in <certificate-file> | openssl md5
openssl rsa -noout -modulus -in <key-file> | openssl md5

<certificate-file> is the certificate and <key-file> the private key. The two lines of output match when they belong together. This check is for RSA keys.

Choose the certificate on the load balancer

For a new load balancer, you do this on Details; see Fill in the details. For a load balancer you already have:

1. In MyAccount, under Compute, click Load Balancers, click the load balancer, and open its Info tab.
2. Click Edit beside Frontend Protocol or SSL. The edit form opens.
3. Under Frontend Protocol, choose HTTPS to serve on port 443 only, or Both (HTTP and HTTPS) to serve on ports 80 and 443.
4. Under SSL, choose your certificate.
5. (Optional) With Both (HTTP and HTTPS), tick HTTP Redirect; see Redirect HTTP to HTTPS.
6. Click Submit.

The change takes about 5 to 10 minutes, and the load balancer reads Deploying until the change is applied. If it stays in Deploying far longer than that, see The load balancer stays on Creating, Deploying, or Upgrading.

Each load balancer takes a single certificate. To serve several domains, use one certificate that covers them all, such as a wildcard or multi-domain certificate.

The load balancer’s security group must allow port 443, and port 80 for Both (HTTP and HTTPS), from your users. See Manage a load balancer’s network and security groups.

Redirect HTTP to HTTPS

To redirect plain HTTP to HTTPS, choose Both (HTTP and HTTPS) and tick HTTP Redirect; the redirect works only with Both (HTTP and HTTPS). The load balancer then answers each plain HTTP request on port 80 with a redirect to the same address over HTTPS. It applies to every path, and ACL rules do not change it.

When you create the load balancer, tick HTTP Redirect on Details. For a load balancer you already have:

1. On the Info tab, click Edit beside Frontend Protocol.
2. Check that Frontend Protocol is Both (HTTP and HTTPS).
3. Tick HTTP Redirect, and click Submit.

On the Info tab, HTTP Redirect under Peak Performance Features reads True once it is on, and False otherwise.

Renew or replace the certificate

A renewed certificate takes effect once you choose it again:

1. Import the renewed certificate, with its private key and chain, as a new certificate. See Import the certificate.
2. On the load balancer’s Info tab, click Edit beside SSL, choose the renewed certificate, and click Submit.
3. Wait until the load balancer reads Running again.

Delete the old certificate from SSL Certificates once no load balancer uses it. While one uses it, the delete is refused with SSL is currently enabled on the Load Balancer. It cannot be deleted.

Encrypt traffic to your servers

The certificate encrypts traffic between your users and the load balancer. To keep traffic encrypted from the load balancer to your servers too, set the backend group’s Backend Protocol to HTTPS, with your servers serving HTTPS on the server port. See Choose the backend protocol (ALB).

Check that HTTPS works

To test HTTPS by name, point your domain’s A record at the load balancer’s Public IP first.

When the load balancer reads Running, request your site over HTTPS, where <your-domain> is a name the certificate covers:

curl -I https://<your-domain>/

The first line shows the status your site answered with, such as HTTP/2 200.

To see the certificate itself, open https://<your-domain>/ in a browser, and view the site’s certificate there. Use the domain name, since the certificate covers the names on it rather than the load balancer’s IP.

If your certificate is missing from the SSL list, see My certificate is missing from the SSL list.