I use a CDN in my environment so one trick I’ve used is to terminate TLS traffic at the CDN (where there is no limit on certs) then all origin traffic goes thro

I use a CDN in my environment so one trick I’ve used is to terminate TLS traffic at the CDN (where there is no limit on certs) then all origin traffic goes through a single ELB with a CA issued but throwaway cert the users never see, then on the backend do further routing by hostname and path to S3, lambda, other backend instances, etc. if you are going to have a CDN anyway you aren’t giving up anything. Plus connections between The CDN and the ELB can be pooled and kept alive for long periods so you don’t do much handshaking there.