Howto install the api gateway client certificate into Elastic beanstalk

Question

I have a scalable application on elastic beanstalk running on Tomcat. I read that in front of Tomcat there is an Apache server for reverse proxy. I guess I have to install on apache the client certificate and configure it to accept only request encrypted by this certificate, but I have no idea how to do that.

Can you help me?

Answer 1

After many researches I found a solution. According to the difficult to discover it I want share with you my experience.

My platform on elastic beanstalk is Tomcat 8 with load balancer.

To use the client certificate (at the moment I was writing) you have to terminate the https on instance

http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-singleinstance.html

then

http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-singleinstance-tomcat.html

I used this configuration to use both client and server certificates (seems that it doesn't work only with client certificate)

    SSLEngine             on
    SSLCertificateFile    "/etc/pki/tls/certs/server.crt"
    SSLCertificateKeyFile "/etc/pki/tls/certs/server.key"
    SSLCertificateChainFile "/etc/pki/tls/certs/GandiStandardSSLCA2.pem"
    SSLCipherSuite        EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
    SSLProtocol           All -SSLv2 -SSLv3
    SSLHonorCipherOrder   On
    SSLVerifyClient       require
    SSLVerifyDepth        1
    SSLCACertificateFile  "/etc/pki/tls/certs/client.crt"

And last thing: api gateway doesn't work with self signed cerificate (thanks to Client certificates with AWS API Gateway), so you have to buy one from a CA.

SSLCACertificateFile  "/etc/pki/tls/certs/client.crt"

This is where you should point the API Gateway provided client side certificate.