Description of problem:
Follow steps in [1] to provisioning OCP. It failed during creating ELB.

[1]. /usr/share/ansible/openshift-ansible/playbooks/aws/README.md

Version-Release number of the following components:
atomic-openshift-utils-3.7.0-0.178.0.git.0.27a1039.el7
ansible-2.4.0.0-5.el7

How reproducible:
100%

Steps to Reproduce:
1.
2.
3.

Actual results:
# ansible-playbook -i inventory.yml /usr/share/ansible/openshift-ansible/playbooks/aws/openshift-cluster/provision_install.yml -e @provisioning_vars.yml -vvv
...
TASK [openshift_aws : Create ELB weshi-cluster-master-external] ******************************************************************************************************************************
task path: /usr/share/ansible/openshift-ansible/roles/openshift_aws/tasks/elb.yml:32
Using module file /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/_ec2_elb_lb.py
<127.0.0.1> ESTABLISH LOCAL CONNECTION FOR USER: root
<127.0.0.1> EXEC /bin/sh -c 'echo ~ && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-1509006543.09-179931132085111 `" && echo ansible-tmp-1509006543.09-179931132085111="` echo /root/.ansible/tmp/ansible-tmp-1509006543.09-179931132085111 `" ) && sleep 0'
<127.0.0.1> PUT /tmp/tmpVsSC3D TO /root/.ansible/tmp/ansible-tmp-1509006543.09-179931132085111/_ec2_elb_lb.py
<127.0.0.1> EXEC /bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-1509006543.09-179931132085111/ /root/.ansible/tmp/ansible-tmp-1509006543.09-179931132085111/_ec2_elb_lb.py && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '/usr/bin/python2 /root/.ansible/tmp/ansible-tmp-1509006543.09-179931132085111/_ec2_elb_lb.py; rm -rf "/root/.ansible/tmp/ansible-tmp-1509006543.09-179931132085111/" > /dev/null 2>&1 && sleep 0'
The full traceback is:
Traceback (most recent call last):
  File "/tmp/ansible_oHxxM6/ansible_module_ec2_elb_lb.py", line 1372, in <module>
    main()
  File "/tmp/ansible_oHxxM6/ansible_module_ec2_elb_lb.py", line 1359, in main
    elb_man.ensure_ok()
  File "/tmp/ansible_oHxxM6/ansible_module_ec2_elb_lb.py", line 416, in _do_op
    return op(*args, **kwargs)
  File "/tmp/ansible_oHxxM6/ansible_module_ec2_elb_lb.py", line 491, in ensure_ok
    self._create_elb()
  File "/tmp/ansible_oHxxM6/ansible_module_ec2_elb_lb.py", line 723, in _create_elb
    scheme=self.scheme)
  File "/usr/lib/python2.7/site-packages/boto/ec2/elb/__init__.py", line 242, in create_load_balancer
    params, LoadBalancer)
  File "/usr/lib/python2.7/site-packages/boto/connection.py", line 1208, in get_object
    raise self.ResponseError(response.status, response.reason, body)
boto.exception.BotoServerError: BotoServerError: 400 Bad Request
<ErrorResponse xmlns="http://elasticloadbalancing.amazonaws.com/doc/2012-06-01/">
  <Error>
    <Type>Sender</Type>
    <Code>ValidationError</Code>
    <Message>Secure Listeners need to specify a SSLCertificateId</Message>
  </Error>
  <RequestId>ba403395-ba27-11e7-8b6c-f3b27607c9ef</RequestId>
</ErrorResponse>


fatal: [localhost]: FAILED! => {
    "changed": false, 
    "failed": true, 
    "module_stderr": "Traceback (most recent call last):\n  File \"/tmp/ansible_oHxxM6/ansible_module_ec2_elb_lb.py\", line 1372, in <module>\n    main()\n  File \"/tmp/ansible_oHxxM6/ansible_module_ec2_elb_lb.py\", line 1359, in main\n    elb_man.ensure_ok()\n  File \"/tmp/ansible_oHxxM6/ansible_module_ec2_elb_lb.py\", line 416, in _do_op\n    return op(*args, **kwargs)\n  File \"/tmp/ansible_oHxxM6/ansible_module_ec2_elb_lb.py\", line 491, in ensure_ok\n    self._create_elb()\n  File \"/tmp/ansible_oHxxM6/ansible_module_ec2_elb_lb.py\", line 723, in _create_elb\n    scheme=self.scheme)\n  File \"/usr/lib/python2.7/site-packages/boto/ec2/elb/__init__.py\", line 242, in create_load_balancer\n    params, LoadBalancer)\n  File \"/usr/lib/python2.7/site-packages/boto/connection.py\", line 1208, in get_object\n    raise self.ResponseError(response.status, response.reason, body)\nboto.exception.BotoServerError: BotoServerError: 400 Bad Request\n<ErrorResponse xmlns=\"http://elasticloadbalancing.amazonaws.com/doc/2012-06-01/\">\n  <Error>\n    <Type>Sender</Type>\n    <Code>ValidationError</Code>\n    <Message>Secure Listeners need to specify a SSLCertificateId</Message>\n  </Error>\n  <RequestId>ba403395-ba27-11e7-8b6c-f3b27607c9ef</RequestId>\n</ErrorResponse>\n\n", 
    "module_stdout": "", 
    "msg": "MODULE FAILURE", 
    "rc": 0
}
	to retry, use: --limit @/usr/share/ansible/openshift-ansible/playbooks/aws/openshift-cluster/provision_install.retry

PLAY RECAP ***********************************************************************************************************************************************************************************
localhost                  : ok=32   changed=3    unreachable=0    failed=1   

Expected results:
ELB could create successfully 

Additional info:
Seems ssl_certificate_id has been set to '':

$ grep -nir "openshift_aws_elb_cert_arn" .
./roles/openshift_aws/defaults/main.yml:54:openshift_aws_elb_cert_arn: ''
./roles/openshift_aws/defaults/main.yml:68:      ssl_certificate_id: "{{ openshift_aws_elb_cert_arn }}"
./roles/openshift_aws/tasks/iam_cert.yml:19:  - openshift_aws_elb_cert_arn == ''
./roles/openshift_aws/tasks/iam_cert.yml:23:- name: set_fact openshift_aws_elb_cert_arn
./roles/openshift_aws/tasks/iam_cert.yml:25:    openshift_aws_elb_cert_arn: "{{ elb_cert_chain.arn }}"
./roles/openshift_aws/tasks/iam_cert.yml:30:  - openshift_aws_elb_cert_arn == ''