kops: WIP terraform support for --api-ssl-certificate

terraform-cert.diff

diff --git a/upup/pkg/fi/cloudup/awstasks/load_balancer.go b/upup/pkg/fi/cloudup/awstasks/load_balancer.go
index 257c2b066..01baebd99 100644
--- a/upup/pkg/fi/cloudup/awstasks/load_balancer.go
+++ b/upup/pkg/fi/cloudup/awstasks/load_balancer.go
@@ -657,6 +657,7 @@ type terraformLoadBalancerListener struct {
 	InstanceProtocol string `json:"instance_protocol"`
 	LBPort           int64  `json:"lb_port"`
 	LBProtocol       string `json:"lb_protocol"`
+	SSLCertificateID string `json:"ssl_certificate_id,omitempty"`
 }
 
 type terraformLoadBalancerHealthCheck struct {
@@ -696,13 +697,19 @@ func (_ *LoadBalancer) RenderTerraform(t *terraform.TerraformTarget, a, e, chang
 		if err != nil {
 			return fmt.Errorf("error parsing load balancer listener port: %q", loadBalancerPort)
 		}
-
-		tf.Listener = append(tf.Listener, &terraformLoadBalancerListener{
+		tl := terraformLoadBalancerListener{
 			InstanceProtocol: "TCP",
 			InstancePort:     listener.InstancePort,
 			LBPort:           loadBalancerPortInt,
 			LBProtocol:       "TCP",
-		})
+		}
+		if e.SSLCertificateID != "" {
+			tl.InstanceProtocol = "SSL"
+			tl.LBProtocol = "SSL"
+			tl.SSLCertificateID = e.SSLCertificateID
+		}
+
+		tf.Listener = append(tf.Listener, &tl)
 	}
 
 	if e.HealthCheck != nil {