Reference
Create Free Public SSL Certificate to be used with ALB. This will be simpler than using Let’s Encrypt certificate as additional script will need to be maintained for Let’s Encrypt cert renewal.
From the EC2 Management Console, click “Services” in the top bar and search for “certificate.” Open the Certificate Manager.
Click on “Get Started” under “Provision Certificates.”
This certificate will be used for securing connections over the internet, so it should be public. Select “public” and click “Request.”
Now you can add your domain name to the certificate. AWS certificates support wildcards, so it might be useful to include "*.yourdomain.com" as well, to secure any subdomains you may have. Add any domain you need, then click “Next.”
Now, you’ll need to verify your domain. AWS offers two types of verification: DNS, and Email.
DNS will require you to add a CNAME record to your domain name. If you’re using AWS Route 53 as your DNS provider, this is easy, but if you’re using something else, the process can take hours to verify.
Email only takes a few minutes. AWS will send an email to the registered WHOIS contact, as well as "admin@yourdomain.com" and a few other common webadmin emails. If you don’t have private email for your domain, you can usually set up email forwarding to a public Gmail account from your registrar’s settings, which will work just as well.
If you’re going with DNS verification, copy the “Name” and “Value” from the domain dropdown. If you’re verifying multiple domains, check if the values are different, as you may have to verify them individually.
From your DNS provider’s settings, add a new CNAME record, and paste the name and value into the form (this interface will vary depending on your provider).
While DNS only takes a few minutes to propagate, AWS may take a few hours to validate the domain, so maybe grab some lunch. If you’re using email verification, it should only take a few minutes after clicking the link in your email.
Once it’s done, you should see the orange “Pending validation” switch to a green “Issued.” You won’t have to download anything; the certificate is automatically usable in other AWS services.