Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by AWS Certificate Manager

How to fix it

In the console

EC2 → Load balancers → the load balancer → Listeners → Manage listeners

Default SSL cert

From ACM on every HTTPS and SSL listener: an ACM-issued, DNS-validated certificate in this Region, so it renews itself

With the AWS CLI

aws elb set-load-balancer-listener-ssl-certificate --load-balancer-name <load-balancer-name> --load-balancer-port 443 --ssl-certificate-id <acm-certificate-arn> --region <region>

With Terraform

resource "aws_elb" "this" {
  listener {
    lb_port            = 443
    lb_protocol        = "https"
    instance_port      = 443
    instance_protocol  = "https"
    ssl_certificate_id = var.acm_certificate_arn
  }
}