ListenerCertificate

Source: src/AWS/ELBv2/ListenerCertificate.ts

Attaches an additional SNI certificate to an ELBv2 HTTPS/TLS listener. The listener’s default certificate is configured on the Listener itself; ListenerCertificate adds extra certificates that the load balancer selects via Server Name Indication (SNI) based on the requested hostname.

Use this resource when the certificates are managed independently of the listener (e.g. one certificate per tenant domain). When the full certificate list is known up front, prefer the listener’s certificates prop, which declaratively syncs the whole set.

Attaching Certificates

const listener = yield* Listener("https", {
  loadBalancerArn: lb.loadBalancerArn,
  targetGroupArn: tg.targetGroupArn,
  port: 443,
  protocol: "HTTPS",
  certificateArn: defaultCertArn,
});
yield* ListenerCertificate("tenant-cert", {
  listenerArn: listener.listenerArn,
  certificateArn: tenantCertArn,
});