If you’re using a standard install, you need to point only to the ec2. Putting a load balancer in front is rather tricky.
If you’ve done many rebuilds with the dns pointing to multiple addresses, you may not have a valid cert and not be able to get one due to rate limits. If that’s the case, use a different name or wait a week.