Configuring SSL on Elastic Beanstalk Single Instance

I'm trying to install an SSL cert for my NodeJS Beanstalk instance. Following these instructions from Amazon, I created the YAML file and plugged in my information.

Every time I try to deploy I get this error:

The configuration file .ebextensions/singlessl.config in application version 0.0.3 contains invalid YAML or JSON. YAML exception: while scanning for the next token found character '\t' that cannot start any token in "", line 10, column 1: ^ , JSON exception: Unexpected character (R) at position 0.. Update the configuration file.

I've gone over the thing with a fine-toothed comb, had it validated in multiple validators, even authored it on multiple OS's... but I can't seem to shake this supposed tab character.

Does anyone have an example of a config file like this in JSON? My other configs are in JSON and work great. If not, can anyone see what I'm doing wrong here?

Resources:
  sslSecurityGroupIngress: 
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: {Ref : MyIDHere}
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      CidrIp: 0.0.0.0/0

files:
  /etc/nginx/conf.d/ssl.conf:
    mode: "000755"
    owner: root
    group: root
    content: |
      # HTTPS server

      server {
          listen       443;
          server_name  localhost;

          ssl                  on;
          ssl_certificate      /etc/pki/tls/certs/server.crt;
          ssl_certificate_key  /etc/pki/tls/certs/server.key;

          ssl_session_timeout  5m;

          ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
          ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
          ssl_prefer_server_ciphers   on;

          location / {
              proxy_pass  http://nodejs;
              proxy_set_header   Connection "";
              proxy_http_version 1.1;
              proxy_set_header        Host            $host;
              proxy_set_header        X-Real-IP       $remote_addr;
              proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
          }
      }

  /etc/pki/tls/certs/server.crt:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN CERTIFICATE-----
      CERT DATA HERE
      -----END CERTIFICATE-----

/etc/pki/tls/certs/server.key:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN RSA PRIVATE KEY-----
      KEY DATA HERE
      -----END RSA PRIVATE KEY-----