Matching certificate for VPC-Link HTTPS endpoint in API Gateway

3
votes

I would like to change my API from HTTP to HTTPs in API Gateway, but get the following error: 

Endpoint request headers: {x-amzn-apigateway-api-id=ghqsfz8w25, 
Accept=application/json, User-Agent=AmazonAPIGateway_xxxx, 
Host=xxx-nlb-ecs-service-xxx-xxxcea41.elb.eu-west-1.amazonaws.com, 
X-Amzn-Trace-Id=Root=1-xxx-xxx}
Endpoint request body after transformations: 
Sending request to https://xxx-nlb-ecs-service-xxx-xxxcea41.elb.eu-west-1.amazonaws.com
Execution failed due to configuration error: 
Host name 'vpce-xxx007-xxxb1h.vpce-svc-xxx318ce.eu-west-1.vpce.amazonaws.com' does 
not match the certificate subject provided by the peer (CN=*.domain.eu)
Method completed with status: 500

With the following configuration:

  • A wildcard certificate *.domain.eu is used
  • The wildcard certificate is assigned to the NLB 443 listener
  • The NLB is integrated with vpce-svc-xxx318ce endpoint in VPC Endpoint Services (AWS PrivateLink)
  • The wildcard certificate is assigned to the custom domain in API-GW
  • The custom domain includes mappings to different APIs (like: api.domain.eu/api1v1, api.domain.eu/api2v1)

The settings of the API method are

With HTTP this configuration was working. Now it seems that I need to associate the VPC endpoint with the wildcard certificate. It is my first experience with AWS and I am not a network expert. Any ideas how I can fix this issue.

Thanks in advance!

1
amazon-web-servicesaws-api-gatewayamazon-ecsamazon-route53
I have the exact same issue. The VPC endpoint is already associated with the VPC itself and not reachable from outside. So I guess API Gateway in fact already sends the traffic into the VPC. If you want to terminate ssl on your load balancer and the nlb is internal my understanding would be terminating SSL on API Gateway (http for endpoint url) is fine. Missing some documentation about it specifically with ACM and Private Link integration. – Tim

1 Answers

2
votes

To make this work

  • Use ACM to provision a cert for a private zone you control, e.g. domain.eu
  • Create A-Alias record for the NLB, e.g. vpclink-nlb.domain.eu
  • Update the NLB listener to use the above cert
  • Update the API Gateway Method Integration Endpoint URL to https://vpclink-nlb.domain.eu