> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/aws-saa-c02/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/aws-saa-c02/elb/ssl-certificates.md).

# SSL Certificates

* **SSL and TLS are both cryptographic protocols** that **provide authentication and data encryption** between servers, machines, and applications operating **over a network**.

## HTTP Listener

* You **can create an HTTPS listener, which uses encrypted connections (also known as SSL offload).**
  * This feature **enables traffic encryption between your load balancer and the clients that initiate SSL or TLS sessions**.<br>
* To use an HTTPS listener, you **must deploy at least one SSL/TLS server certificate on your load balancer**.<br>
* The **load balancer uses a server certificate to terminate the front-end connection and then decrypt requests from clients before sending them to the targets**.<br>
* The **load balancer requires X.509 certificates** (SSL/TLS server certificates).<br>
* **Certificates are a digital form of identification issued by a certificate authority** (CA).

## Server Name Indication (**SNI**)

* When a browser connects to your TLS-enabled ALB, **ALB presents a certificate that contains your site’s public key**, which has been cryptographically signed by a CA.
  * **This way the client can be sure it’s getting the ‘real you’** and that it’s safe to use your site’s public key to establish a secure connection.<br>
* With SNI support, AWS makes it easy to **use more than one certificate with the same ALB**.<br>
* The **most common reason you might want to use multiple certificates is to handle different domains with the same load balancer**.<br>
* SNI is supported by over 99.5% of clients connecting to CloudFront.<br>
* **Only works with ALBs and NLBs**.<br>
* **Support:**
  * **CLBs:**

    * **Only support 1 SSL certificate**, so to get multiple certificates, you **must use multiple CLBs**.

  * **ALBs and NLBs:**
    * **Use SNI** to **support multiple listeners with multiple certificates**.