Put a secure connection on your site — Certificate Manager and HTTPS

Your goal

Plan HTTPS for a website served by an AWS load balancer.

Why this matters

Visitors should be able to check the site’s identity and send data over an encrypted connection. You will request a certificate, prove control of the name, and attach it to the web entry point.

Words you will use

HTTPS protects traffic between browser and server. A TLS certificate helps prove the server’s identity. ACM manages certificates for supported AWS services.

How to proceed

Read each situation and choose an answer. The lesson explains the result. Try again if needed, then continue through all three decisions and finish the tour.

1. Match the website name

Visitors will open https://shop.example.com. You are requesting a certificate for an Application Load Balancer. Choose the name it needs to cover.

Which name must the certificate cover?

shop.example.com, directly or with a suitable wildcard.

The browser checks the visited hostname against the certificate. Request coverage for the actual name. For a load balancer, choose the correct AWS region for that resource.

The certificate request matches the hostname visitors will use.

Certificate name: shop.example.com

2. Prove control of the name

ACM asks you to add a DNS validation record. This step helps prevent strangers from requesting a certificate for your name. Choose what to do.

How should you complete DNS validation?

Add the exact provided record in the domain’s DNS.

The DNS record proves control of the domain. Keep the required validation record for managed renewal. Issuance and renewal depend on meeting the service’s requirements.

The domain-control check can complete.

ACM validation record → domain DNS → validation succeeds

3. Use the certificate

Your certificate is issued, but visitors still connect to an HTTP-only listener. A certificate sitting unused does not change the connection. Choose the next step.

Where should it be used?

On an HTTPS listener for the load balancer.

Attach the matching certificate to the HTTPS listener and test the site. Also plan HTTP-to-HTTPS redirects and monitor renewal. Encryption does not replace app sign-in or permissions.

The web entry point can serve the matching site over HTTPS.

HTTPS listener :443 → matching ACM certificate → app targets

Practice, then check your understanding

In the interactive tour, make each decision before seeing the outcome. Wrong answers receive coaching, and replay gives you a fresh attempt without duplicating earned XP.

Read the official AWS documentation for service behavior and production details.