This is how we generate the ssl cert using openssl:
#!/bin/bash
mkdir -p "$SSL_DIR"
openssl req \
-x509 \
-newkey rsa:4096 \
-keyout "$SSL_DIR/collector_key.pem" \
-out "$SSL_DIR/collector_cert.pem" \
-days 3650 \
-nodes \
-subj "/C=UK/O=Acme/OU=DevOps/CN=*.acme.com"
openssl pkcs12 \
-export \
-out "$SSL_DIR/collector.p12" \
-inkey "$SSL_DIR/collector_key.pem" \
-in "$SSL_DIR/collector_cert.pem" \
-passout "pass:$CERT_PW"
chmod 644 "$SSL_DIR/collector.p12"
As suggested in this post: Enable https on collector; ALB cannot target ECS - #3 by josh