SSL Certificates and SSL Offload

The process of deploying SSL certificates with ACM involves:

• Requesting a certificate: Initiate a certificate request within ACM for our domain.

• Validating domain ownership: Validate our ownership of the domain using either DNS validation or email validation methods provided by AWS.

• Deploying the certificate: Once validated, deploy our certificate to AWS services seamlessly integrated with ACM.

Understanding SSL offload

SSL Offload is a technique used to optimize the performance of our web servers by offloading the CPU-intensive process of encrypting and decrypting SSL traffic to a load balancer. In the context of AWS, this is commonly implemented using Elastic Load Balancing (ELB), which can handle the SSL decryption process, allowing our application servers to focus on delivering content without the overhead of encryption tasks. This enhances server performance and centralizes the management of our SSL certificates.

Note: Besides Elastic Load Balancing, AWS Certificate Manager (ACM) also integrates with services such as Amazon CloudFront, Amazon API Gateway, and AWS Nitro Enclaves for SSL/TLS certificate management across the AWS platform.

Key benefits

Here are some important benefits of SSL offloading:

• Enhanced performance: Offloading the decryption process to ELB allows our application servers to operate more efficiently, handling more user requests by focusing on delivering content rather than decrypting traffic.

• Simplified certificate management: ACM’s integration with ELB simplifies the management of our SSL certificates, centralizing the deployment and renewal process.

• Security: While SSL offload significantly improves performance and management, it’s important to maintain end-to-end encryption for sensitive applications. Ensure that our application’s architecture and security policies align with SSL Offload, considering any requirements for encryption to be maintained up to the application server.