Client Certificates with AWS API Gateway

Question

I am trying to implement mutual authentication for communication between an aws-api gateway and my server. I want to use client-side certificates that amazon offers for authentication. I know that my server is configured correctly, because I used to use the lambda function and mutual authentication worked.

I exported a certificate (.PEM) and added it to a trusted store. I configured the Jetty server to use this trust for authentication. I installed client-auth for: necessary. I know that my server is configured correctly because it worked with my self-implemented SSL interface. All I did was change the trust store. When I check my method gateway, the value 200 is returned: {"message": "Unknown endpoint error." }

Here is an excerpt from the server log files. The server-side handshake seems to be completed, but there is an error with the client certificate.

pConnection @ 3a0a2e84 {FILLING} completed server-side completion 2015-09-28 13: 04: 29 856 DEBUG [qtp1980278840-19] oejiChannelEndPoint - blushed 45 SelectChannelEndPoint @ 2c05eeb2 {ec2-xx-xxx-xxx-x.compute-1.amazon .com / 5x.xxx.xxx.x: 43942 ↔ 4000, Open, in, out, -, -, 0/200000, SslConnection} {Io = 0, KIO = 0, cro = 1} 2015-09-28 13 : 04: 29 856 DEBUG [qtp1980278840-19] oejisSslConnection - SslConnection @ 50e2de43 {NOT_HANDSHAKING, eio = 0/0, di = -1} → HttpConnection @ 3a0a2e84 {FILL} flush exit, consumed 0 2015-09-28 13: 0 : 29,856 DEBUG [qtp1980278840-19] oejisSslConnection - SslConnection @ 50e2de43 {NOT_HANDSHAKING, eio = 0 / -1, di = -1} → HttpConnection @ 3a0a2e84 {FILLING} UPLOAD Status = BUFFER_UNDERFUSHAHANDHANDINGHAND NOTHINGHAND

Answer 1

I solved this problem. The server logs I posted are misleading. No handshake occurs because the server certificate that I used was itself signed, not signed by a trusted CA. As of 9/28/2015, aws api gateway requires a certificate signed by a trusted certificate authority. Since my certificate was signed on its own, server (and client) handshakes do not complete. We hope that this problem will be resolved in future versions.