Internal Application Load Balancers for a municipal intranet only need trust from city-managed devices, not from public browsers on the internet. Which certificate approach fits?
Select an answer to reveal the explanation.
Short Explanation
Intranet badges are not passport stamps. Private CA certs fit internal ALBs that only city gear trusts; public ACM certs are for the internet edge. Turning TLS off inside the VPC still leaves room for snooping and broken policy.
Full Explanation
Internal Application Load Balancers serving a municipal intranet should use certificates from a private trust domain. ACM Private CA (with private certificates issued to those ALBs) fits because only city-managed devices need to trust the endpoints; public browser trust is not required. Reserve publicly trusted ACM certificates for internet-facing endpoints where citizens’ browsers must validate without installing municipal roots. This split keeps internal PKI manageable and avoids forcing public issuance for private hostnames.
Issuing free public certificates from a random untrusted CA and ignoring trust errors trains users to click through warnings and breaks secure-by-default posture. Permanently ignoring self-signed certificate errors on every citizen or staff laptop is operationally brittle and unsafe. Disabling HTTPS on internal ALBs because the VPC is private neglects encryption in transit inside the network and fails policies that require TLS everywhere.
Exam caveat: public ACM certificates cannot be freely exported for arbitrary non-ACM integrations the way some expect; Private CA is the tool for private trust. Operational check: issue private certs to internal ALB listeners, distribute the Private CA trust chain via device management, confirm clients trust without warnings, and keep public ACM only on external citizen portals.