Client SSL Authentication - AWS API Gateway
I'm looking at utilizing AWS API Gateway for some of our services. The implementation so far takes an API defined on the AWS Gateway, and then proxy that traffic to an F5 external endpoint, which routes it accordingly to the correct services within our environment. AWS API Gateway provides a Client Certificate feature (http://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html) which we'd like to use, but the feature-set is not very rich at this point. As I understand it, F5 does offer this type of service, but from what I've gleaned with my testing...it requires a real certificate (and more importantly an actual signing CA), which AWS does not provide in this context. Does anyone know of a way to bypass the normal certificate checks? The idea would be to require a client-certificate and then validate via a subject and serial number match, and if they don't reject.
I did try importing the self-signed certificate and use that as the "CA" in this case, but it didn't pass validation.
Thanks.
Turns out I mainly just fat fingered the actual SSL configuration, and AWS API Gateway doesn't provide a nice error when it simply can't validate the initial chain applied to a virtual server. Overall, this worked as expected. Import the client certificate created on AWS into the F5, use it to be the "Trusted Certificate authority" for Client authentication on the SSL profile, and voila. Future enhancements on AWS would make this simpler, but for now it does work.