An Application Load Balancer HTTPS listener requires an SSL/TLS certificate managed by AWS Certificate Manager (ACM). The certificate must be in the same AWS region as your ALB. Once issued, copy its ARN into the "certificateArn" field on your ALB node. Alternatively, if you do not need HTTPS on the ALB (e.g. it sits behind CloudFront which already handles TLS, or it's an internal ALB within your VPC), disable "HTTPS Listener (ALB)" in the property panel — no certificate is then required.
Paste into this field
ALB → certificateArnOutput looks like
arn:aws:acm:us-east-1:123456789012:certificate/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxIn the AWS Console, use the region selector (top-right) to switch to the same region as your ALB. Then navigate to Certificate Manager (search "ACM").
Click "Request a certificate", choose "Request a public certificate", then click Next.
Enter your domain (e.g. app.example.com). Add a wildcard (*.example.com) if you want to cover all subdomains. Click Next.
Select "DNS validation" (recommended — no email required). Click Request.
ACM shows a CNAME name + value. Log into your DNS provider (Route 53, Cloudflare, etc.) and add this CNAME record exactly as shown. ACM checks for it automatically.
Refresh the certificate list. DNS validation usually completes in 2–5 minutes. Status changes from "Pending validation" to "Issued".
Click into the certificate. At the top of the detail page, copy the "ARN" value. It looks like: arn:aws:acm:REGION:ACCOUNT:certificate/UUID
Select your ALB node on the canvas → open the property panel → paste the ARN into "ACM Certificate ARN".
Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.
CloudStack Canvas · Validation Guide