Connect Classic ELB to EC2 Tomcat with Client Authentication

0
votes

How to connect an ELB HTTPS to an EC2 HTTPS Tomcat

Setup:

Classic ELB:

  1. SSL CA Signed Certificate

EC2 Tomcat:

  1. Keystore - Self Signed
  2. Trust Store - Imported a certificate from Salesforce
  3. Client Auth = True

Additional Notes:

  • It is working if clientAuth='false'

Infrastructure Overview: Salesforce -> SSL ELB -> SSL EC2

2
amazon-web-servicestomcatamazon-ec2client

2 Answers

0
votes

As SSL Certificate is deployed on ELB, it will terminate the connection on ELB with client, decrypt the requests and then send them to the backend instances. Thats why, the request works with clientAuth = false.

If you just need an authentication per Salesforce certificate(depends on your security policies), set security groups such that traffic is allowed on ELB only on port 443 and clientAuth = false as ELB has already made sure that the connection is encrypted with client.

In case, you need additional security, you can follow the instructions here to setup authentication with back-end instances as well. Hope it helps.

0
votes

I got this working by using TCP in both the Health check and the listener.