Which AWS architecture solution is used to validate the client's certificate ?

Question

For example, we are using **Route 53** + **ACM** + **ALB** + **ECS**.

With this set of services, could you explain how to **enable client's certificate validation** ?

**More precisely :**

The goal is to establish a **mutual authentication** between the application and the clients :
the application entry point is the Application Load Balancer, the clients come from the Internet.

The application needs to guarantee the client identity from their certificate.

We know that we can create an HTTPS listener for the Application Load Balancer (ALB).

Now, how to go further and establish mutual authentication, i.e. to require and to validate client certificates ?

*Thank you for your expertise.*

Accepted Answer

AFAIK mTLS is not supported on ALB since it always terminates the TLS connection. You can use a NLB instead to redirect the L4 traffic to a server which can deal with mTLS such as NGINX.

Hope it helps.

Answer

Not sure if I understand your question correctly but You can use API gateway to configure client-side SSL authentication for sending requests to the integration endpoint (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-clientcertificate.html ) . 
For your own public domain You can configure certificate validation by DNS or Email validation. Validation is done by the server the same way the client validates the server's certificate through a signed certificate .Certificates managed in ACM use RSA keys with a 2048-bit modulus and SHA-256.

Which AWS architecture solution is used to validate the client's certificate ?

Relevant content