Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by AWS Certificate Manager

How to fix it

Point every HTTPS or SSL listener on the Classic Load Balancer at a certificate from AWS Certificate Manager rather than one uploaded to IAM, so renewal is automatic rather than a diary entry. Request or import the certificate in the load balancer's Region first, then set it on the listener's port. A certificate IMPORTED into ACM does not renew itself; only an ACM-issued one does, and only while its validation record stays in DNS.

In the console

EC2 -> Load balancers -> the load balancer -> Listeners -> SSL certificate

With the AWS CLI

aws elb set-load-balancer-listener-ssl-certificate --load-balancer-name <load-balancer-name> --load-balancer-port 443 --ssl-certificate-id <acm-certificate-arn> --region <region>

With Terraform

resource "aws_elb" "this" {
  listener {
    lb_port            = 443
    lb_protocol        = "https"
    instance_port      = 443
    instance_protocol  = "https"
    ssl_certificate_id = var.acm_certificate_arn
  }
}