When you use HTTPS for your front-end listener, you must deploy an SSL/TLS certificate on your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt requests from clients before sending them to the back-end instances. The TLS protocol uses an X.509 certificate (SSL/TLS server certificate) to authenticate both the client and the back-end application. An X.509 certificate is a digital form of identification issued by a trusted certificate authority (CA) and contains identification information, a validity period, a public key, a serial number, and the digital signature of the issuer.
You can create a certificate using a Third Party Certificate Authority or AWS Certificate Manager.

• Note: an SSL certificate configured on the ELB is not mandatory if you are
  terminating SSL connections directly on the EC2 instances, and using a
  TCP listener on the ELB (TCP pass-through)