diff --git a/senza/components/elastic_load_balancer.py b/senza/components/elastic_load_balancer.py
index 1a0fdb4..68972bd 100644
--- a/senza/components/elastic_load_balancer.py
+++ b/senza/components/elastic_load_balancer.py
@@ -76,13 +76,11 @@ def get_ssl_cert(subdomain, main_zone, configuration, account_info: AccountArgum
     return ssl_cert
 
 
-def get_listeners(subdomain, main_zone, configuration,
-                  account_info: AccountArguments):
-    ssl_cert = get_ssl_cert(subdomain, main_zone, configuration, account_info)
+def get_listeners(configuration):
     return [
         {
             "PolicyNames": [],
-            "SSLCertificateId": ssl_cert,
+            "SSLCertificateId": configuration.get('SSLCertificateId'),
             "Protocol": "HTTPS",
             "InstancePort": configuration["HTTPPort"],
             "LoadBalancerPort": 443
@@ -90,6 +88,16 @@ def get_listeners(subdomain, main_zone, configuration,
     ]
 
 
+def resolve_ssl_certificates(listeners, subdomain, main_zone, account_info):
+    new_listeners = []
+    for listener in listeners:
+        if listener.get('Protocol') in ('HTTPS', 'SSL'):
+            ssl_cert = get_ssl_cert(subdomain, main_zone, listener, account_info)
+            listener['SSLCertificateId'] = ssl_cert
+        new_listeners.append(listener)
+    return new_listeners
+
+
 def component_elastic_load_balancer(definition,
                                     configuration: dict,
                                     args: TemplateArguments,
@@ -123,7 +131,8 @@ def component_elastic_load_balancer(definition,
             subdomain = domain['Subdomain']
             main_zone = domain['Zone']  # type: str
 
-    listeners = configuration.get('Listeners') or get_listeners(subdomain, main_zone, configuration, account_info)
+    listeners = configuration.get('Listeners') or get_listeners(configuration)
+    listeners = resolve_ssl_certificates(listeners, subdomain, main_zone, account_info)
 
     health_check_protocol = configuration.get('HealthCheckProtocol') or 'HTTP'
 

Make property overwriting for senza components less destructive
When using a senza component to build a stack, it would be great if it was possible to overwrite properties in a less destructive way. 

### Expected Behavior
We are using the default component `WeightedDnsElasticLoadBalancer`. Now we want to open port 80 in addition to port 443 in order to allow our application to redirect users from http to https. We want to keep all of the configuration and extend it with one additional entry.

### Actual Behavior
Currently this is not possible, because we can only use the option to overwrite the `Listeners` property like this:
```
  - AppLoadBalancer:
      Type: Senza::WeightedDnsElasticLoadBalancer
      ...
      Listeners:
      - LoadBalancerPort: 80
        Protocol: HTTP
        InstancePort: 80
        InstanceProtocol: HTTP
      - LoadBalancerPort: 443
        Protocol: HTTPS
        InstancePort: 80
        InstanceProtocol: HTTP
        SSLCertificateId: "????"
```
Doing this, we completely miss out on the ease of use that the component provides with regard to selecting the correct SSL certificate, because our definition completely overwrites the one senza creates.

--

As a solution it would be nice if we could either flag our `Listeners` entry as "these are additional, not a replacement" or alternatively have a way of tell senza to inject the SSLCertificateId.
diff --git a/tests/test_components.py b/tests/test_components.py
index dfbf912..a7fe6f0 100644
--- a/tests/test_components.py
+++ b/tests/test_components.py
@@ -198,6 +198,31 @@ def test_component_load_balancer_http_only(monkeypatch):
     assert 'Bar' == result["Resources"]["test_lb"]["Properties"]["Listeners"][0]["Foo"]
 
 
+def test_component_load_balancer_listeners_ssl(monkeypatch):
+    configuration = {
+        "Name": "test_lb",
+        "SecurityGroups": "",
+        "HTTPPort": "9999",
+        "Listeners": [{"Protocol": "SSL"}]
+    }
+    info = {'StackName': 'foobar', 'StackVersion': '0.1'}
+    definition = {"Resources": {}}
+
+    args = MagicMock()
+    args.region = "foo"
+
+    mock_string_result = MagicMock()
+    mock_string_result.return_value = "foo"
+    monkeypatch.setattr('senza.components.elastic_load_balancer.resolve_security_groups', mock_string_result)
+
+    get_ssl_cert = MagicMock()
+    get_ssl_cert.return_value = 'my-ssl-arn'
+    monkeypatch.setattr('senza.components.elastic_load_balancer.get_ssl_cert', get_ssl_cert)
+
+    result = component_elastic_load_balancer(definition, configuration, args, info, False, MagicMock())
+    assert 'my-ssl-arn' == result["Resources"]["test_lb"]["Properties"]["Listeners"][0]["SSLCertificateId"]
+
+
 def test_component_load_balancer_namelength(monkeypatch):
     configuration = {
         "Name": "test_lb",

pip install -e .
parse_log_pytest
requirements.txt
pytest pytest-cov mock
apt-get update apt-get install -y gcc
3.9
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
boto3==1.37.23
botocore==1.37.23
certifi==2025.1.31
charset-normalizer==3.4.1
click==8.1.8
clickclick==20.10.2
coverage==7.8.0
dnspython==1.15.0
dnspython3==1.15.0
exceptiongroup==1.2.2
idna==3.10
importlib_metadata==8.6.1
iniconfig==2.1.0
jmespath==1.0.1
mock==5.2.0
packaging==24.2
pluggy==1.5.0
pystache==0.6.8
pytest==8.3.5
pytest-cov==6.0.0
python-dateutil==2.9.0.post0
PyYAML==6.0.2
raven==6.10.0
requests==2.32.3
s3transfer==0.11.4
six==1.17.0
stups-cli-support==1.1.22
stups-pierone==1.1.56
-e git+https://github.com/zalando-stups/senza.git@5df821c7b09729f59debf89c0ff1e4068340cbc1#egg=stups_senza
stups-tokens==1.1.19
stups-zign==1.2
tomli==2.2.1
typing==3.7.4.3
urllib3==1.26.20
zipp==3.21.0

name: senza
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=25.0=py39h06a4308_0
  - python=3.9.21=he870216_1
  - readline=8.2=h5eee18b_0
  - setuptools=75.8.0=py39h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - tzdata=2025a=h04d1e81_0
  - wheel=0.45.1=py39h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - boto3==1.37.23
      - botocore==1.37.23
      - certifi==2025.1.31
      - charset-normalizer==3.4.1
      - click==8.1.8
      - clickclick==20.10.2
      - coverage==7.8.0
      - dnspython==1.15.0
      - dnspython3==1.15.0
      - exceptiongroup==1.2.2
      - idna==3.10
      - importlib-metadata==8.6.1
      - iniconfig==2.1.0
      - jmespath==1.0.1
      - mock==5.2.0
      - packaging==24.2
      - pluggy==1.5.0
      - pystache==0.6.8
      - pytest==8.3.5
      - pytest-cov==6.0.0
      - python-dateutil==2.9.0.post0
      - pyyaml==6.0.2
      - raven==6.10.0
      - requests==2.32.3
      - s3transfer==0.11.4
      - six==1.17.0
      - stups-cli-support==1.1.22
      - stups-pierone==1.1.56
      - stups-tokens==1.1.19
      - stups-zign==1.2
      - tomli==2.2.1
      - typing==3.7.4.3
      - urllib3==1.26.20
      - zipp==3.21.0
prefix: /opt/conda/envs/senza

tests/test_components.py::test_component_load_balancer_listeners_ssl
tests/test_components.py::test_weighted_dns_load_balancer tests/test_components.py::test_weighted_dns_load_balancer_with_different_domains tests/test_components.py::test_check_docker_image_exists
tests/test_components.py::test_invalid_component tests/test_components.py::test_component_iam_role tests/test_components.py::test_get_merged_policies tests/test_components.py::test_component_load_balancer_healthcheck tests/test_components.py::test_component_load_balancer_idletimeout tests/test_components.py::test_component_load_balancer_cert_arn tests/test_components.py::test_component_load_balancer_http_only tests/test_components.py::test_component_load_balancer_namelength tests/test_components.py::test_component_stups_auto_configuration tests/test_components.py::test_component_stups_auto_configuration_vpc_id tests/test_components.py::test_component_redis_node tests/test_components.py::test_component_redis_cluster tests/test_components.py::test_component_taupage_auto_scaling_group_user_data_without_ref tests/test_components.py::test_component_taupage_auto_scaling_group_user_data_with_ref tests/test_components.py::test_component_taupage_auto_scaling_group_user_data_with_lists_and_empty_dict tests/test_components.py::test_component_auto_scaling_group_configurable_properties tests/test_components.py::test_component_auto_scaling_group_custom_tags tests/test_components.py::test_component_auto_scaling_group_configurable_properties2 tests/test_components.py::test_component_auto_scaling_group_metric_type tests/test_components.py::test_component_auto_scaling_group_optional_metric_type tests/test_components.py::test_to_iso8601_duration tests/test_components.py::test_normalize_asg_success tests/test_components.py::test_normalize_network_threshold tests/test_components.py::test_check_application_id tests/test_components.py::test_check_application_version tests/test_components.py::test_get_load_balancer_name tests/test_components.py::test_weighted_dns_load_balancer_v2 tests/test_components.py::test_max_description_length tests/test_components.py::test_component_load_balancer_default_internal_scheme tests/test_components.py::test_component_load_balancer_v2_default_internal_scheme
senza/components/elastic_load_balancer.py
senza/components/elastic_load_balancer.py