DOP-C02 Question 385
Single answerYour organization is hosting a public-facing application on Amazon Elastic Load Balancer (ELB) and requires secure communication using HTTPS. The security team has mandated the use of an in-house Certificate Authority (CA) to issue SSL/TLS certificates for this application. How can you securely apply the certificate to the ELB while minimizing management overhead?
- A
Use AWS Certificate Manager (ACM) to import the certificate issued by the in-house CA and associate it with the ELB.
- B
Use an Amazon EC2 instance to host the certificate and configure the instance as an SSL termination proxy in front of the ELB.
- C
Manually upload the certificate to the ELB via the AWS Management Console and manage certificate rotation manually.
- D
Use AWS Certificate Manager (ACM) to issue a new certificate signed by an AWS-managed CA and associate it with the ELB.
Show answer and explanation
Correct answer: A
Explanation
The best way to securely apply the in-house CA-issued certificate to the ELB while minimizing management overhead is to use AWS Certificate Manager (ACM). ACM allows you to import certificates issued by an external CA and handles deployment, renewal, and rotation of certificates automatically when associated with services like ELB. This approach aligns with the security team's requirements and reduces operational complexity compared to alternatives such as manual management or hosting certificates on EC2 instances.
- A. Correct.
This is the correct option. AWS Certificate Manager (ACM) supports importing externally issued certificates, including those from an in-house CA. This minimizes management overhead by allowing ACM to handle SSL/TLS certificate deployment and rotation.
- B. Incorrect.
Using an EC2 instance as an SSL termination proxy is not recommended because it introduces unnecessary complexity, additional cost, and operational overhead compared to using AWS native services.
- C. Incorrect.
Manually uploading the certificate to the ELB is possible but requires you to handle certificate rotation manually, which increases management overhead and the risk of expired certificates.
- D. Incorrect.
This option does not meet the requirements because the security team has mandated the use of an in-house CA. AWS-managed CAs cannot issue certificates signed by your in-house CA.