Lecture 185: ELB SSL/TLS
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:00
- 来源：Udemy Lecture 28555991
- Slide 数量：6
- 画面切换：01:15、02:43、03:28、03:51、05:18
扫描说明
逐条读取了 Udemy 页面中的 139 条英文 Transcript cue，并按时间轴扫描全长约 06:00 的视频。依据 TLS Termination、SNI 工作方式、CLB 的 SAN 限制、ALB/NLB 的 SNI 支持、Security Policy 与 Forward Secrecy 划分为 6 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 在 ELB 终止 TLS，并用 ACM 管理证书
时间范围：00:00–01:15
总结 / Summary
中文
客户端可通过 HTTPS 加密连接访问 ELB，由 Load Balancer 加载 SSL/TLS Certificate 并终止加密，再在 Private VPC 内向 EC2 转发 HTTP。证书通常由 AWS Certificate Manager（ACM）管理，也可把自有证书上传至 ACM。HTTPS Listener 必须指定 Default Certificate，并可配置额外 Certificate List 以支持多个域名。
English
Clients can reach the ELB over encrypted HTTPS. The load balancer loads an SSL/TLS certificate, terminates encryption, and can forward HTTP to EC2 inside the private VPC. Certificates are normally managed with AWS Certificate Manager (ACM), which can also import your own certificates. An HTTPS listener requires a default certificate and may include an optional certificate list for multiple domains.
Transcript
00:00 Okay, so let's talk
00:00 about SSL encryption for your Elastic Load Balancer.
00:04 So this is our classic architecture,
00:06 and the idea is that you could have termination
00:09 at the ELB level
00:10 by having an SSL or TLS certificate loaded onto it.
00:13 In which case, while our users will access our ELB
00:17 using an encrypted connection
00:18 for example, HTTPS, but there is going to be a termination
00:22 because then the ELB will just send HTTP traffic
00:25 over your prior VPC into your EC2 instances.
00:30 So you would load an SSL or TLS certificate
00:32 on the ELB and to manage these certificates,
00:35 you need to use ACM, which is AWS Certificate Manager.
00:39 You can upload your own certificates as well onto ACM
00:42 and then have them used by the ELB.
00:44 For your HTTPS listener,
00:46 you must specify a default certificate
00:49 and you can have as well an optional list of certificates
00:52 if you wanted to support multiple domains.
00:54 And as we'll see,
00:55 there's something called Server Name Indication, SNI,
00:58 to allow clients to specify the domain
01:00 the hostname they're gonna trying to reach
01:02 and therefore your ELB will be able to send back
01:05 the correct certificates.
01:07 You can also specify an SSL Security Policy
01:10 for compliance features, compatibility, or security
01:12 as we'll see in the very next slides.
2. SNI 让一个 Listener 为多个主机名选择证书
时间范围：01:15–02:43
总结 / Summary
中文
Server Name Indication（SNI）解决一台 Web Server 或一个 Load Balancer 同时承载多个网站和多个证书的问题。客户端在最初 TLS Handshake 中声明目标 Hostname，ALB/NLB 据此返回匹配证书；这要求客户端支持较新的 SNI 协议。SNI 与 ALB 的 Host-based Routing 配合，可让不同域名进入各自 Target Group。
English
Server Name Indication (SNI) lets one web server or load balancer host multiple websites and certificates. During the initial TLS handshake, the client sends the destination hostname so the ALB or NLB can return the matching certificate. This requires an SNI-capable client. Combined with ALB host-based routing, different domains can reach their respective target groups.
Transcript
01:15 So now let's talk about SNI or Server Name Indication.
01:19 The idea is that SNI will solve the problem
01:21 of loading multiple SSL certificates
01:23 onto one single web server
01:25 that will be serving multiple websites and domains.
01:28 So we have our ALB and say, we have two target groups.
01:31 One is www.mycorp.com, which has EC2 instances.
01:35 And the other target group will be serving demo.example.com
01:39 with other sets of EC2 instances.
01:41 The idea is that on our ALB
01:42 we're going to have routing based on hostname.
01:45 And so therefore the hostname when indicated
01:48 will be served by the right target group.
01:51 Now, we're also going to load a lot of certificates
01:53 on the ALB.
01:54 So we're going to load demo.example.com,
01:57 but also www.mycorp.com as well as maybe other ones
02:00 and a default SSL Certificates.
02:03 What's going to happen
02:03 is that a client when it connects to your ALB,
02:06 will indicate the server name, the hostname.
02:08 So I would like to connect to www.mycorp.com
02:12 and thanks to the SNI feature,
02:14 the ALB will know which SSL certificate
02:17 to use to establish the connection with the clients
02:20 and make sure it is correctly encrypted.
02:22 So SNI is quote in quote, a newer protocol
02:25 and requires the client to indicate the hostname
02:27 of the target it tries to connect to
02:30 during the initial SSL handshake.
02:31 And therefore,
02:32 the server will find the correct certificates.
02:34 This only works therefore for the newer generations types
02:38 of load balancer, such as the Application Load Balancer
02:41 and the Network Load Balancer.
3. CLB 仅支持一个证书，SAN 变更成本高
时间范围：02:43–03:28
总结 / Summary
中文
Classic Load Balancer 只能加载一个 SSL Certificate。虽然证书可通过 Subject Alternative Name（SAN）包含多个 Hostname，但每次新增、编辑或删除域名都要重新签发并重新绑定证书；若需要多个独立证书，通常要部署多个 CLB。能够迁移时，应优先使用支持 SNI 的 ALB。
English
A Classic Load Balancer supports only one SSL certificate. A certificate can cover multiple hostnames through Subject Alternative Names (SANs), but every domain addition, edit, or removal requires reissuing and reassigning the certificate. Multiple independent certificates generally require multiple CLBs, so an SNI-capable ALB is preferable when migration is possible.
Transcript
02:43 Now, these SSL certificates can be loaded onto the CLB.
02:46 So the CLB supports only one SSL certificate.
02:49 And if you wanted to support multiple hostnames
02:51 through your CLB, you would need to use SAN.
02:54 So Subject Alternate Name on your SSL certificates.
02:57 But the idea is that anytime you will need
02:59 to add or remove a domain name,
03:01 you will need to edit the SSL certificate with new SANs.
03:05 And so therefore it is a complicated process
03:07 because you will need to reissue
03:09 and reassign these certificates over time.
03:12 Therefore, sometimes the best option is to use multiple CLBs
03:15 for multiple hostnames with multiple SSL certificates.
03:19 But if you can transition away
03:21 from the CLB and use the ALB instead,
03:23 because the ALB has the Server Name Indication feature
03:26 that we just saw that will simplify your life.
4. ALB 与 NLB 原生支持多 Listener、多证书和 SNI
时间范围：03:28–03:51
总结 / Summary
中文
ALB 和 NLB 都能配置多个 Listener 与多个 SSL Certificate，并使用 SNI 根据客户端声明的 Hostname 选择正确证书。相较 CLB，这避免了把所有域名固化进同一张 SAN Certificate，也简化了证书轮换和多域名扩展。
English
Both ALB and NLB support multiple listeners and multiple SSL certificates, using SNI to choose the correct certificate for the hostname sent by the client. Compared with CLB, this avoids embedding every domain in a single SAN certificate and simplifies certificate rotation and multi-domain growth.
Transcript
03:28 So talking about the ALB,
03:29 it supports multiple HTTPS listeners
03:32 and multiple SSL certificates.
03:34 And then in order to make it work
03:36 with multiple hostnames,
03:37 then we're going to use this Server Name Indication feature,
03:40 the SNI feature we just saw.
03:42 The NLB is similar.
03:43 It supports multiple listeners
03:44 with multiple SSL certificates.
03:46 And we're also going to use SNI
03:48 to serve the correct SSL certificates.
5. Security Policy 控制 TLS 协议、Cipher 与协商顺序
时间范围：03:51–05:18
总结 / Summary
中文
HTTPS/SSL Listener 的 Security Policy 是 TLS/SSL Protocol、Cipher 与 Server Order Preference 的组合，决定握手时可协商的能力。ALB/NLB Frontend Connection 可选择预定义 Policy；课程指出 Backend Connection 固定使用 ELBSecurityPolicy-2016-08。ELBSecurityPolicy-TLS 系列用于满足特定 TLS Version 合规要求，或在必要时兼容 Legacy Client。
English
An HTTPS/SSL listener security policy combines TLS/SSL protocols, ciphers, and server order preference to define what can be negotiated during the handshake. ALB/NLB frontend connections can select a predefined policy, while the course states that backend connections always use ELBSecurityPolicy-2016-08. ELBSecurityPolicy-TLS families enforce selected TLS versions for compliance or support legacy clients when required.
Transcript
03:51 Now, finally, it is possible for you
03:53 to set up a security policy
03:54 for your HTTPS or your SSL listener.
03:58 So security policy is a combination
04:01 of SSL protocols, SSL ciphers
04:04 and Server Order Preference option
04:06 that's going to be supported during the SSL negotiation.
04:10 That is when your client is connecting
04:12 to your server and establishing a secure connection.
04:15 So you can use some predefined security policies
04:18 for example, the ELBSecurityPolicy-2016-08
04:22 and then apply it to your load balancer.
04:25 So if you consider the Application Load Balancer
04:28 and the Network Load Balancer,
04:30 then in case of frontend connections,
04:32 so connections from the client to your load balancer,
04:36 then you can use a predefined security policy.
04:39 And for backend connections,
04:42 then you must use the ELBSecurityPolicy-2016-08.
04:46 It's going to be always used.
04:48 So what can we set for predefined security policy?
04:52 We have different ones.
04:53 We have the default I just showed you.
04:54 But also you can use the ELBSecurityPolicy-TLS policies.
04:58 So in this case, you must meet compliance
05:01 and security standards that require
05:03 to only use certain TLS protocol version.
05:06 That may be something internally within your company.
05:09 And also if you wanted
05:10 to sometimes support older versions
05:13 of SSL and TLS for your legacy clients and application.
6. Forward Secrecy 使用唯一随机 Session Key
时间范围：05:18–06:00
总结 / Summary
中文
若要求 Forward Secrecy，应选择 ELBSecurityPolicy-FS 系列。它在每次协商中使用唯一、随机的 Session Key，为已加密数据增加抵抗事后窃听或长期密钥泄露的保护。考试若强调“每次会话使用唯一随机密钥”，应联想到 Forward Secrecy Policy。
English
When forward secrecy is required, choose an ELBSecurityPolicy-FS family. It negotiates a unique random session key for each connection, adding protection against later decryption of captured traffic or long-term key compromise. On the exam, a requirement for a unique random key per session points to a forward-secrecy policy.
Transcript
05:18 The other kind of policies you may want
05:20 to use is the ELBSecurityPolicy-FS.
05:24 And this is when you require Forward Secrecy.
05:28 So the idea is that with this,
05:30 you're going to get additional safeguards
05:32 against the eavesdropping of encrypted data
05:35 by using during the negotiation,
05:38 a unique, random session key
05:41 and that can come up in the exam.
05:43 So anytime you see,
05:44 how do we use a unique random session key for your ALB,
05:48 think of a Forward Secrecy policy for your load balancer.
05:55 Okay, so that's it for this lecture.
05:57 I hope you liked it.
05:58 And I will see you in the next lecture.
整讲总结 / Overall Summary
中文
ELB 可在 Listener 层终止 TLS，并通过 ACM 管理证书。CLB 仅支持一个证书，多域名依赖 SAN 且更新成本高；ALB/NLB 支持多 Listener、多证书和 SNI，可在握手时按 Hostname 选择证书。HTTPS/SSL Security Policy 决定协议、Cipher 与协商顺序；TLS 系列面向版本与合规，FS 系列提供 Forward Secrecy。
English
ELB can terminate TLS at the listener and manage certificates through ACM. CLB supports one certificate, so multi-domain use relies on SANs and costly reissuance; ALB/NLB support multiple listeners, certificates, and SNI to select a certificate by hostname during the handshake. HTTPS/SSL security policies govern protocols, ciphers, and negotiation order; TLS families address version and compliance needs, while FS families provide forward secrecy.
返回顶部 ↑