How to Enable HTTPS on AWS Elastic Beanstalk

Elastic Beanstalk's default web-server environment tier provisions a load balancer (an Application Load Balancer, in current platform versions) in front of your application instances. That load balancer is where TLS termination happens, which means enabling HTTPS is mostly an ACM-and-load-balancer-configuration task rather than something you change in your application code.

1. Request or import a certificate for your domain in ACM, in the same region as your Elastic Beanstalk environment (unlike CloudFront, this does not need to be us-east-1).
2. In the EB console, open your environment's Configuration, find the Load Balancer settings, and add a listener on port 443 with the HTTPS protocol.
3. Select your ACM certificate for that listener, and choose a security policy (which sets the minimum TLS version and cipher suites the listener will accept).
4. If you want to force HTTP traffic to redirect rather than serve insecurely, that redirect is typically configured as a rule on the port 80 listener, or handled at the application/web-server layer inside your environment.

Because the exact configuration screens and option names have shifted across Elastic Beanstalk platform versions over the years, treat the console's current field names as the source of truth over any specific screenshot you find online — the underlying concept (an ACM certificate attached to a load balancer listener) has stayed consistent even where the exact console layout hasn't.

Single-instance environments are the exception

A single-instance environment (used for low-traffic or dev/test workloads) doesn't provision a load balancer by default, so there's no listener to attach a certificate to. For these, the common patterns are either switching to a load-balanced environment tier, or placing CloudFront or another TLS-terminating proxy in front of the single instance instead.

Making load balancer settings survive environment rebuilds

Console changes to load balancer configuration can be lost if an environment is rebuilt or recreated from scratch. Storing the same settings in a .ebextensions configuration file inside your application source bundle, rather than only clicking through the console, makes the HTTPS listener part of your deployable environment configuration going forward. The exact option-setting keys are platform-tier-specific enough that we'd point you to Elastic Beanstalk's own current configuration-options documentation for the precise syntax rather than risk giving you a stale example here.

Health checks after adding an HTTPS listener

Adding an HTTPS listener doesn't change your target group's health check protocol by itself — health checks commonly continue running over HTTP against your instances internally, which is normal and doesn't indicate misconfiguration. Don't assume you need to force health checks onto HTTPS as well; check your specific target group settings if you're unsure which protocol they're using.