If it&#x27;s all going in AWS, I don&#x27;t see a huge difference between terminating in the ELB vs. terminating on the VMs.  It might help you if the ELB got misconfigured, but AWS managing&#x2F;provisioning the keys keeps them safe from being misplaced, too, so on balance it&#x27;s probably better.<p>If you had on-premise servers, or a different&#x2F;more secure host vs. intermediary&#x2F;load-balancer, I could see the value of end to end.  (especially if you have a long-lived cert, a pinned cert, EV, whatever).<p>(and of course crypto between the intermediary and the servers, if it&#x27;s not on a physically secured LAN segment)