Configuring mutual TLS on an Application Load Balancer - Elastic Load Balancing
Create a trust storeAssociate a trust storeView trust store detailsModify a trust storeDelete a trust store

Configuring mutual TLS on an Application Load Balancer

This section includes the procedures for configuring mutual TLS verify mode for authentication on Application Load Balancers.

To use mutual TLS passthrough mode, you only need to configure the listener to accept any certificates from clients. When you use mutual TLS passthrough, the Application Load Balancer sends the whole client certificate chain to the target using HTTP headers, which enables you to implement corresponding authentication and authorization logic in your application. For more information, see Create an HTTPS listener for your Application Load Balancer.

When you use mutual TLS in verify mode, the Application Load Balancer performs X.509 client certificate authentication for clients when a load balancer negotiates TLS connections.

To utilize mutual TLS verify mode, perform the following:

  • Create a new trust store resource.

  • Upload your certificate authority (CA) bundle and, optionally, revocation lists.

  • Attach the trust store to the listener that is configured to verify client certificates.

Follow the procedures in this section to configure mutual TLS verify mode on your Application Load Balancer in the AWS Management Console. To configure mutual TLS by using API operations instead of the console, see the Application Load Balancer API Reference Guide.

Create a trust store

There are three ways that you can create a trust store: when you create an Application Load Balancer, when you create a secure listener, and by using the Trust Store console. When you add a trust store when you create a load balancer or listener, the trust store is automatically associated with the new listener. When you create a trust store by using the Trust Store console, you must associate it with a listener yourself.

This section covers creating a trust store using the Trust Store console, but the steps used while creating an Application Load Balancer or listener are the same. For more info, see Configure a load balancer and a listener and Create an HTTPS listener.

Prerequisites:

  • To create a trust store, you must have a certificate bundle from your Certificate Authority (CA).

To create a trust store using the console

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. On the navigation pane, choose Trust Stores.

  3. Select Create trust store.

  4. Trust store configuration

    1. For Trust store name enter a name for your trust store.

    2. For Certificate authority bundle enter the Amazon S3 path to the ca certificate bundle you want your trust store to use.

      Optional: Use Object version to select a previous version of the ca certificate bundle. Otherwise the current version is used.

  5. For Revocations you can optionally add a certificate revocation list to your trust store.

    1. Under Certificate revocation list enter the Amazon S3 path to the certificate revocation list you want your trust store to use.

      Optional: Use Object version to select a previous version of the certificate revocation list. Otherwise the current version is used.

  6. For Trust store tags you can optionally enter up to 50 tags to apply to your trust store.

  7. Select Create trust store.

Associate a trust store

After you create a trust store, you must associate it with a listener before your Application Load Balancer can begin using the trust store. You can have only one trust store associated to each of your secure listeners, but one trust store can be associated to multiple listeners.

This section covers associating a trust store to an existing listener. Alternatively, you can associate a trust store while creating an Application Load Balancer or listener. For more info, see Configure a load balancer and a listener and Create an HTTPS listener.

To associate a trust store using the console

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. On the navigation pane, choose Load Balancers.

  3. Select the load balancer to view its details page.

  4. On the Listeners and rules tab, choose the link in the Protocol:Port column to open the details page for the secure listener.

  5. On the Security tab, choose Edit secure listener settings.

  6. (Optional) If mutual TLS is not enabled, select Mutual authentication (mTLS) under Client certificate handling and then choose Verify with trust store.

  7. Under Trust store, choose the trust store that you created.

  8. Choose Save changes.

View trust store details

CA certificate bundles

The CA certificate bundle is a required component of the trust store. It's a collection of trusted root and intermediate certificates that have been validated by a certificate authority. These validated certificates ensure the client can trust the certificate being presented is owned by the load balancer.

You can view the contents of the current CA certificate bundle in your trust store at any time.

View a CA certificate bundle

To view a CA certificate bundle using the console

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. On the navigation pane, choose Trust Stores.

  3. Select the trust store to view the details page.

  4. Choose Actions, then Get CA bundle.

  5. Choose Share link, or Download.

Certificate revocation lists

Optionally, you can create a certificate revocation list for a trust store. Revocation lists are released by certificate authorities and contain data for certificates that have been revoked. Application Load Balancers only support certificate revocation lists in the PEM format.

When a certificate revocation list is added to a trust store, it's given a revocation ID. The revocation IDs increase for every revocation list added to the trust store, and they cannot be changed. If a certificate revocation list is deleted from a trust store, it's revocation ID is also deleted and is not reused for the life of the trust store.

Note

Application Load Balancers cannot revoke certificates that have a negative serial number, within a certificate revocation list.

View a certificate revocation list

To view a revocation list using the console

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. On the navigation pane, choose Trust Stores.

  3. Select the trust store to view the details page.

  4. On the Certificate revocation lists tab, select Actions, then Get revocation list.

  5. Choose Share link, or Download.

Modify a trust store

A trust store can only contain one CA certificate bundle at a time, but you can replace the CA certificate bundle at any time after the trust store is created.

Replace a CA certificate bundle

To replace a CA certificate bundle using the console

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. On the navigation pane, choose Trust Stores.

  3. Select the trust store to view the details page.

  4. Choose Actions, then Replace CA bundle.

  5. On the Replace CA bundle page, under Certificate authority bundle enter the Amazon S3 location of the desired CA bundle.

  6. (Optional) Use Object version to select a previous version of the certificate revocation list. Otherwise the current version is used.

  7. Select Replace CA bundle.

Add a certificate revocation list

To add a revocation list using the console

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. On the navigation pane, choose Trust Stores.

  3. Select the trust store to view it's details page.

  4. On the Certificate revocation lists tab, select Actions, then Add revocation list.

  5. On the Add revocation list page, under Certificate revocation list enter the Amazon S3 location of the desired certificate revocation list

  6. (Optional) Use Object version to select a previous version of the certificate revocation list. Otherwise the current version is used.

  7. Select Add revocation list

Delete a certificate revocation list

To delete a revocation list using the console

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. On the navigation pane, choose Trust Stores.

  3. Select the trust store to view the details page.

  4. On the Certificate revocation lists tab, select Actions, then Delete revocation list.

  5. Confirm the deletion by typing confirm.

  6. Select Delete.

Delete a trust store

When you no longer have use for a trust store, you can delete it.

Note: You cannot delete a trust store that is currently associated with a listener.

To delete a trust store using the console

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. On the navigation pane, choose Trust Stores.

  3. Select the trust store to view it's details page.

  4. Choose Actions, then Delete trust store.

  5. Confirm the deletion by typing confirm.

  6. Select Delete