Classic Load Balancer SSL listeners use ACM certificates

Check ID: elb_ssl_listeners_use_acm_certificate
Provider: AWS
Service: elb
Severity: MEDIUM
Categories: encryption
Resource type: AwsElbLoadBalancer

What this check verifies

Classic Load Balancer HTTPS/SSL listeners use AWS Certificate Manager certificates that are Amazon-issued (certificate type AMAZON_ISSUED).

Risk

Using imported or non Amazon-issued certificates reduces control over issuance and rotation, increasing chances of expired or weak TLS. This can trigger service outages and enable man-in-the-middle interception, compromising data confidentiality and integrity.

Recommendation

Standardize on Amazon-issued ACM certificates for CLB HTTPS/SSL listeners to ensure managed validation and automatic renewal. Apply least privilege to certificate operations, automate rotation, and monitor certificate health as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elb set-load-balancer-listener-ssl-certificate —load-balancer-name <load-balancer-name> —load-balancer-port <port> —ssl-certificate-id <acm_certificate_arn>

# Terraform: Attach an Amazon-issued ACM cert to a CLB HTTPS/SSL listener
resource "aws_elb" "<example_resource_name>" {
  availability_zones = ["<example_az>"]

  listener {
    lb_port            = 443
    lb_protocol        = "https"
    instance_port      = 443
    instance_protocol  = "https"
    ssl_certificate_id = "<acm_certificate_arn>" # critical: Amazon-issued ACM cert to satisfy ELB.2
  }
}

# CloudFormation: Attach an Amazon-issued ACM cert to a CLB HTTPS/SSL listener
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      AvailabilityZones:
        - <example_az>
      Listeners:
        - LoadBalancerPort: 443
          InstancePort: 443
          Protocol: HTTPS
          SSLCertificateId: <acm_certificate_arn>  # critical: use Amazon-issued ACM certificate to pass ELB.2

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elb_ssl_listeners_use_acm_certificate. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Elastic Load Balancer has only HTTPS or SSL listeners ELBv2 load balancer has cross-zone balancing enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires