How to add an SSL (ACM) to ElasticBeanstalk with a Network Load Balancer

Question

I'm using ElasticBeanstalk and need a static IP for our application, so I use a Network Load Balancer instead of an application load balancer.
The problem is that when I "Select the check box for the 443 listener and choose Actions, Add SSL certificates for SNI, " it is disabled.

I also tried to manually add the certificate via https-nlb.config
option_settings:
  aws:elbv2:listener:443:
    ListenerEnabled: 'true'
    Protocol: TLS
    SSLCertificateArns: ****************
  aws:elasticbeanstalk:environment:process:https:
    Port: '443'
    Protocol: HTTPS

But I'm getting this error:
Invalid option value: 'HTTPS' (Namespace: 'aws:elasticbeanstalk:environment:process:https', OptionName: 'Protocol'): Only TCP Protocols are supported for Network Load Balancers.

re:Post Agent · Answer

To add an SSL certificate (ACM) to Elastic Beanstalk with a Network Load Balancer (NLB), you need to make some adjustments to your configuration. The issue you're encountering is because Network Load Balancers operate at the transport layer (Layer 4) and only support TCP and TLS protocols, not HTTP or HTTPS directly.

Here's how you can configure it correctly:

1. First, ensure that your ACM certificate is available in the same region as your Elastic Beanstalk environment.

2. Modify your configuration file (e.g., https-nlb.config) as follows:

```
option_settings:
aws:elbv2:listener:443:
ListenerEnabled: 'true'
Protocol: TLS
SSLCertificateArns: arn:aws:acm:region:account-id:certificate/certificate-id
aws:elasticbeanstalk:environment:process:https:
Port: '443'
Protocol: TCP
```

Note the changes:
- The listener protocol is set to TLS (not HTTPS)
- The process protocol is set to TCP (not HTTPS)
- Replace the placeholder in SSLCertificateArns with your actual ACM certificate ARN

3. The Network Load Balancer will handle the TLS termination, and then forward the decrypted traffic to your instances using TCP.

4. Your application should be configured to listen on port 443 for the incoming TCP traffic.

5. If you need to handle HTTP traffic as well, you can add another listener for port 80:

```
aws:elbv2:listener:80:
ListenerEnabled: 'true'
Protocol: TCP
aws:elasticbeanstalk:environment:process:http:
Port: '80'
Protocol: TCP
```

Remember that with a Network Load Balancer, you're responsible for SSL/TLS handling at the application level if needed, as the NLB doesn't process the HTTP layer.

By making these adjustments, you should be able to successfully add your SSL certificate to your Elastic Beanstalk environment using a Network Load Balancer while maintaining the static IP address benefit.  
**Sources**  
[Configuring a Network Load Balancer - AWS Elastic Beanstalk](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environments-cfg-nlb.html)  
[Configuring HTTPS Termination at the load balancer - AWS Elastic Beanstalk](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https-elb.html)  
[Server certificates - AWS Elastic Beanstalk](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https.certificate.html)

IXJohn · Answer

Hi,
I already fixed that error by adding a TLS protocol, the issue now is how do I use an SSL certificate via ACM to ensure we can use port 443 with a valid certificate?

Vinodkumar Mandalapu · Answer

Hi John,

you can use the below settings  to use an SSL certificate via ACM via ACM to ensure we can use port 443 with a valid certificate?

option_settings:
  aws:elbv2:listener:443:
    DefaultProcess: https
    ListenerEnabled: 'true'
  aws:elasticbeanstalk:environment:process:https:
    Port: '443'
SSLCertificateArns:

Sharing the Reference urls 
https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environments-cfg-nlb.html
https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-elbv2-listener

Please let me know if you need any additional help.

IXJohn · Answer

I am still getting errors after updating my settings to:
option_settings:
  aws:elbv2:listener:443:
    DefaultProcess: https
    ListenerEnabled: 'true'
    Protocol: TLS
    SSLCertificateArns: *********
  aws:elasticbeanstalk:environment:process:https:
    Port: '443'
    Protocol: TCP

![Enter image description here](/media/postImages/original/IMdXuGR2_ITi2NanrnmpjSlw)

Vinodkumar Mandalapu · Answer

Hi John,

Error indicates that in your configuration files you are using https instead of TCP, Network Load Balancers operate at the transport layer (Layer 4) and only support TCP and TLS protocols, not HTTP or HTTPS directly.

can you please modify the configurations accordingly and redeploy the same and do let us know if you are still facing any issues.

How to add an SSL (ACM) to ElasticBeanstalk with a Network Load Balancer

Relevant content