Can an ELB enforce TLS authentication?

Question

I am using AWS::ElasticLoadBalancingV2::LoadBalancer and we need to start using client certificates (i.e. mTLS / two-way TLS). Our ELB is terminating TLS connections and has a server side certificate.

Can the ELB itself be configured to enforce client authentication (by giving it a certificate for example)?

Chewy

Answer 1

As I answered in your previous question, this is not a supported feature of AWS load balancers at this time. You have to switch to a load balancer type that supports TCP passthrough, and handle mTLS on your server.

Munday

just to be sure, this question is not about passthrough - it is about whether the ELB itself can request the client certificate and authenticate the client. The backend plays no part in the mTLS in this case. – Chewy

I understand the question. I don't feel like you're taking the time to read my answers. I'm telling you there is no way to have the ELB request a client certificate. AWS load balancers do not support mutual TLS. There is no way to make that work on the load balancer itself. So if you want to support mutual TLS in your application, the only option you have is to configure the load balancer in TCP passthrough, and handle mutual TLS yourself. – Munday

Answer 2

As of the announcement at AWS re:Invent 2023 in November, there is finally support for mTLS for ALBs, and you can use AWS's PCA (Private CA) to manage client certs.

Announcement: https://aws.amazon.com/blogs/aws/mutual-authentication-for-application-load-balancer-to-reliably-verify-certificate-based-client-identities/

How-To: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/mutual-authentication.html

Private CA: https://docs.aws.amazon.com/privateca/latest/userguide/PcaWelcome.html

Arlenaarlene

Answer 3

While an AWS load balancer doesn't provide mTLS authentication via a client-provided certificate, you could do that by instead using an API Gateway.

There's an example blog post from AWS here showing how it works: https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/

Sinistrodextral