# Ensure ELB ACM certificate required - Source: https://support.icompaas.com/support/solutions/articles/62000224134-ensure-elb-acm-certificate-required - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Description:** AWS Certificate Manager (ACM) handles the complexity of creating, storing, and renewing public and private SSL/TLS X.509 certificates and keys that protect your AWS websites and applications. You can provide certificates for your integrated ACM services either by issuing them directly with ACM or by importing third-party certificates into the ACM management system. ACM certificates can secure singular domain names, multiple specific domain names, wildcard domains, or combinations of these. ACM wildcard certificates can protect an unlimited number of subdomains. You can also export ACM certificates signed by ACM Private CA for use anywhere in your internal PKI. ### **Rationale:** Checks if the Classic Load Balancers use SSL certificates provided by AWS Certificate Manager. To use this rule, use an SSL or HTTPS listener with your Classic Load Balancer. This rule is only applicable to Classic Load Balancers. This rule does not check Application Load Balancers and Network Load Balancers. ### **Impact:** When an ELB has any listeners that are not configured to use a secure protocol, such as HTTPS or SSL, the front-end connection between the client and the load balancer is vulnerable to eavesdropping and man-in-the-middle (MITM) attacks. The risk becomes even higher when transmitting sensitive private data such as credit card numbers. If your ELBs are using insecure listeners, such as HTTP, apply the information provided in this guide (see Remediation) to update their configuration. ### **Default Value:** When you create an HTTPS listener, you must specify exactly one certificate This certificate is known as the   default certificate . You can replace the default certificate after you create the HTTPS listener ### **Pre-Requisite:** 1. SSL certificate is required. 2. Update each ELB configuration to use listeners with HTTPS or SSL protocols  ### **Remediation** ### **Test Plan** 1. Login to the AWS Management Console. 2. Open the Amazon EC2 console at  [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/"). 3. In the navigation panel, under **LOAD BALANCING**, click **Load Balancers**.![](https://support.icompaas.com/assets/kb/c5c6680812b1afd4.png) 4. Select the Elastic Load Balancer that you want to examine. ![](https://support.icompaas.com/assets/kb/d3d60b341c0ec3a9.png)  5. Select the **Listeners** tab from the bottom panel. ![](https://support.icompaas.com/assets/kb/c5274d18b7da9d22.png)  6. Under **Load Balancer Protocol** column, check the protocol for each listener available. If there is no listener using the HTTPS or SSL protocol, the selected ELB listeners configuration is not secure (the front-end connection is not encrypted). ![](https://support.icompaas.com/assets/kb/a087232fa4c64115.png)  **Using AWS CLI:** **To describe the load balancer**  aws elb describe-load-balancers --region us-east-1 --load-balancer-name MyWebELB --query 'LoadBalancerDescriptions\[\*\].ListenerDescriptions' ### **Implementation Steps:** 1. Login to the AWS Management Console. 2. Navigate to the EC2 dashboard at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). 3. In the navigation panel, under LOAD BALANCING, click Load Balancers.![](https://support.icompaas.com/assets/kb/0117457032c820e0.png) 4. Select the Elastic Load Balancer that you want to examine.![](https://support.icompaas.com/assets/kb/33c0af8a762dd25f.png) 5. Select the **Listenerstab** from the bottom panel![](https://support.icompaas.com/assets/kb/b83f8616ad159eb8.png) 6. Click Add  Listeners to add a new entry. ![](https://support.icompaas.com/assets/kb/aec4deb9a4160ed5.png)  7. In the **Load Balancer Protocol** dropdown list, select **HTTPS (Secure HTTP)**.  ![](https://support.icompaas.com/assets/kb/f07aa755b19ebd40.png)   8. Under the **SSL Certificate** column, click **Change** and select one of the following options:  9. **Choose an existing certificate from AWS Certificate Manager (ACM)** - to use an existing SSL certificate purchased via AWS Certificate Manager. If you haven’t purchased any SSL certificates you can click **Request a new ACM certificate** link and AWS will redirect your request to the ACM dashboard where you can buy the certificate. 10. **Choose an existing certificate from AWS Identity and Access Management (IAM)** - to use an existing SSL certificate uploaded previously to AWS IAM through the ELB dashboard. Select the certificate name from the Certificate dropdown list: 11. **Upload a new SSL certificate to AWS Identity and Access Management (IAM)** - deploy an SSL certificate purchased by entering the required information: 12. granted by the SSL provider from which you bought the certificate.![](https://support.icompaas.com/assets/kb/fb081d86ffd8501c.png) 13. Click **add**  to apply the selected SSL certificate.  **Using AWS CLI:** **To add the https listeners**  aws elb create-load-balancer-listeners --load-balancer-name my-load-balancer --listeners "Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80" ## **Back out Plan:** 1. Login to the AWS Management Console. 2. Navigate to the EC2 dashboard  3. In the navigation panel, under LOAD BALANCING, 4. click on Load Balancers you want to examine 5.  Click on Listeners 6. select the listeners you want to Remove 7.  Click on remove **Using AWS CLI:** **To remove the listeners**  aws eld delete-load-balancer-listeners --load-balancer-name --load-balancer-ports **Reference:** [![](https://support.icompaas.com/assets/kb/e84b607ecd4f27b0.png)What is Elastic Load Balancing? - Elastic Load Balancing](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/what-is-load-balancing.html)  [![](https://support.icompaas.com/assets/kb/55f04e270d1645ea.png)Create an HTTPS listener for your Application Load Balancer - Elastic Load Balancing](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html)  [![](https://support.icompaas.com/assets/kb/d6b52c4168524d30.png)Application Load Balancers - Elastic Load Balancing](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html)  [![](https://support.icompaas.com/assets/kb/b7dc5cbcc89857f4.png)What Is AWS Certificate Manager? - AWS Certificate Manager](https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.