Question

A financial services company exposes a partner-facing REST API behind an Application Load Balancer (ALB) with an HTTPS listener. Security policy now requires that only partner client applications presenting a certificate issued by the company's own private certificate authority may connect, and any connection presenting an untrusted or expired client certificate must be rejected at the ALB before reaching the backend targets. The team wants a managed solution that minimizes custom code on the targets. Which approach meets these requirements?

Accepted Answer

Configure mutual TLS (mTLS) on the ALB HTTPS listener in verify mode, using a trust store in Amazon S3 that contains the private CA's certificate bundle, and let the ALB validate and reject untrusted client certificates.

Answer

Enable mTLS on the ALB in passthrough mode and have each backend target application parse the X-Amzn-Mtls-Clientcert header to validate the certificate chain and expiry.

Answer

Place an AWS WAF web ACL on the ALB with a rule that inspects the TLS client certificate and blocks requests when the issuer does not match the private CA.

Answer

Terminate TLS on a Network Load Balancer with a certificate from AWS Private CA, then forward to the ALB, relying on the NLB to authenticate client certificates.