A global sports news company has hosted its website on Amazon EC2 instance using a single Public IP address & is front-ended by TLS-enabled Application Load Balancer. For an upcoming mega sports event, they plan to launch a new website on the existing Amazon EC2 instance. The company has registered a different domain name & possesses a separate TLS certificate for this new website.
As an AWS consultant to this company, which of the following recommendations will you provide to support multiple certificates with existing Public IP addresses in the most cost-effective way? 

Answer options:

A.Launch an additional TLS-enabled ALB front ending Amazon EC2 instance with different certificates for each domain.
B.Use Wildcard certificates on ALB matching old & new domain name.
C.Use a single certificate on ALB & add Subject Alternative Name (SAN) for additional domain name.
D.Use multiple TLS certificates on ALB using Server Name Indication (SNI).

Correct Answer: D
ALB supports Server Name Indication (SNI), enabling hosting multiple domain names with different TLS certificates behind a single ALB. With SNI, multiple certificates can be associated with listeners in ALB, enabling each web application to use separate certificates. The below diagrams shows the process which takes place when a client tries to access a website. Client Browser starts a TLS handshake by sending a ClientHello message which consists of protocol version, extensions, cipher suites, and compression techniques. Based on browser capabilities, ALB responds with a valid certificate for a domain name of the requested web application. 
Option A is incorrect as launching additional ALB will work. But it will incur additional cost & admin work for setup.
Option B is incorrect as using wildcard certificates can be used for related sub-domains & not different domains.
Option C is incorrect as using SAN certificates, for any new addition of domain, all certificates need to revalidate with certificate authority.
For more information on Amazon ALB SNI support, refer to the following URL-
https://aws.amazon.com/blogs/aws/new-application-load-balancer-sni/