I have an Express app running on AWS EB which I want to secure with SSL. From what I understand I can either set this up at the application level using the https module or at the EB environment level by applying the certificate to the load balancer.
I have done the second of these two options and have it working but I'm unsure on the best practice. Should I be doing it at the express application level or via the EB Load balancer or should I be doing both?
Adding SSL certificate at the ELB level is the right choice which I believe should be sufficient.
The advantage is when you have SSL Certificates at ELB level, offloading happens at multiple servers managed by Amazon used for ELBs, reducing the computational demand from your web server. Also the configuration is lean & transparent.
Note: For added security you can place the web servers in private subnets while keeping ELB public.