You can add any ACM certificate you have to a listener, after all this load balancer is a CNAME and would be resolved to your hostname(s) via a DNS record.

However for any ACM certificate you have to be able to verify that you control that domain. As the load balancers domain is owned by Amazon you cannot verify this domain. If you attempt to access the load balancers CNAME directly in the browser it will show as insecure (as the SSL will not be valid for that domain), you will however be able to verify HTTPS works.

The only solution to have a valid HTTPS endpoint will be to use an ACM certificate for a domain you own, and resolve it via that domain name rather than the load balancers CNAME.

I have an Application Load Balancer (ALB) that uses the [default DNS name][1] provided by AWS.  

i.e. name of `my-loadbalancer` in US East is given the DNS name:

`my-loadbalancer-1234567890.us-east-1.elb.amazonaws.com`

[![basic configuration][2]][2]

I have a listener over HTTP that works just fine:

`http://my-loadbalancer-1234567890.us-east-1.elb.amazonaws.com/`

However, when I go to add an **HTTPS Listener**, I need to provide a certificate that matches the current domain.  I can pick something from my ACM store, but they're all for custom domains

[![HTTPS Listener][3]][3]

I can [request a new certificate][4], but not sure how I'd be able to validate against `***.us-east-1.elb.amazonaws.com`

This is a backend service, so I don't need a user friendly domain.

Is there anyway to add HTTPS to a load balancer out of the box?

  [1]: https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/using-domain-names-with-elb.html
  [2]: https://i.stack.imgur.com/b4SOU.png
  [3]: https://i.stack.imgur.com/iSaaP.png
  [4]: https://console.aws.amazon.com/acm/home?region=us-east-1#/wizard/

Add HTTPS Listener to Application Load Balancer

I'm trying to follow the instructions in [How can I allow a Group to assume a Role?][2], but run into the following error when I try to switch roles:

> Invalid information in one or more fields. Check your information or contact your administrator.

----

In this scenario I have three AWS Accounts with `example ids`

* CompanyMain - `000000000001`
* CompanyProd - `000000000002`
* CompanyDev - `000000000003`

Where the main account has an organization that includes the the prod and dev accounts

[![aws organizations][1]][1]

What I'd like to do is set up a single set of IAM users on the main account and allow them to login and switch between either of the two subaccounts, instead of forcing everyone to have three separate logins.


### Here's what I've done so far all on the `CompanyMain` account:

1. **Create Role for accessing Prod Account**

   Set trusted Entity to "Another AWS Account"

   [![Create Role > Another Account][3]][3]

   Set Permission Policy to `AdministratorAccess`

   So when I go to Role > "Trust Relationship" > Show Policy Document - it looks like this:

    ```json
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::000000000002:root"
          },
          "Action": "sts:AssumeRole",
          "Condition": {}
        }
      ]
    }
    ```

    With the name "company-prod-admin" so the ARN is like this:

    ```none
    arn:aws:iam::000000000001:role/company-prod-admin
    ```

    This also comes with the link to switch roles as follows:


    https://signin.aws.amazon.com/switchrole?roleName=company-prod-admin&account=000000000001

2. **Create a Policy to Assume this Role**

   Service: STS
   Actions: AssumeRole
   Role ARN: `arn:aws:iam::000000000001:role/company-prod-admin`

   [![Policy Assume Role][4]][4]

   So the Policy Document looks like this:

    ```json
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "sts:AssumeRole",
          "Resource": "arn:aws:iam::000000000002:root"
        }
      ]
    }
    ```

3. **Create Admin Group**

   Create a group on the main account called `admin` and attach the policy we just created

4. **Create IAM User**

   Create user on the main account and place in `admin` group

### Sign in as IAM User

I can now sign in as an IAM user against the main account

From there, I'd like to switch roles by using the role link or going to https://signin.aws.amazon.com/switchrole and entering the account / role info

[![switch role][5]][5]

However, I get the error that the following info is invalid

### Org Setup Question

How can I create roles that across organizations?  I'm a little confused as to where the role / permission needs to originate between the three accounts, but ideally I'd like to have a way for someone to login to one set of permissions for the whole organization.

  [1]: https://i.stack.imgur.com/AxETP.png
  [2]: https://stackoverflow.com/questions/34922920/how-can-i-allow-a-group-to-assume-a-role
  [3]: https://i.stack.imgur.com/9Ni9l.png
  [4]: https://i.stack.imgur.com/RMpsO.png
  [5]: https://i.stack.imgur.com/dnL1s.png