MTLS on api gateway

Question

I am implementing mtls in Bahrain, i have the client certificate and followed the following steps https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/
also checked the following https://repost.aws/knowledge-center/api-gateway-certificate-domain-tls

When i test the endpoint without mtls, it works. when add the truststore i get "message":"Forbidden" and the logs not available in cloudwatch. No authentication required for now while testing

Anyone encountered the same before? Do i need to import the certificate if using truststore?

Answer

If you get forbidden it actually sounds like you don't present you client cert when calling the API. The truststore should be in S3 and your API should point to that.
Check how you present you client cert to the API you should use a call like this:

```
curl --key my_client.key --cert my_client.pem https://api.yourdomain.com
```

Check my blog on the topic, if that can give some extra hints maybe: 
https://jimmydqv.com/secure-api-gw-with-mutual-tls/

MTLS on api gateway

Relevant content