Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

How do I use AWS Site-to-Site VPN to create a certificate-based VPN?

3 minute read
2

I want to use AWS Site-to-Site VPN for certificate-based Internet Protocol Security (IPsec) VPN authentication. I want this to replace the use of a pre-shared key for Internet Key Exchange (IKE) authentication.

Short description

Site-to-Site VPN supports certificate-based authentication through integration with AWS Private Certificate Authority (AWS Private CA). You can use digital certificates to build IPsec tunnels with static or dynamic customer gateway IP addresses.

Note: You can't use an external self-signed certificate for Site-to-Site VPN. For more information on certificate options, see AWS Site-to-Site VPN tunnel authentication options.

Resolution

To create a certificate-based VPN connection with Site-to-Site VPN, complete the following steps.

Create and install a root and subordinate private CA certificate

Create a root certificate authority (CA) and a subordinate CA in AWS Private CA. Only subordinate CAs hosted in AWS Certificate Manager (ACM) can issue private certificates for AWS Site-to-Site VPN.

For more information about creating a private CA, see Create a private CA in AWS Private CA.

Note: If you prefer to use an external CA, create only the subordinate CA in AWS Private CA. Install a subordinate CA certificate signed by an external parent CA.

Request or create a private certificate

Use AWS Certificate Manager (ACM) to request a private certificate for the customer gateway device that is using the subordinate CA.

Create a customer gateway

Create a customer gateway for your VPN connection:

  1. Open the Amazon Virtual Private Cloud (Amazon VPC) console.
  2. Choose Customer Gateways. Then, choose Create Customer Gateway.
  3. For Name, enter a name for your customer gateway.
  4. For Routing, select the routing type for your use case.
  5. For IP address, do one of the following:
    Keep the field empty if the IP address is dynamic.
    Keep the field empty or specify the IP address if it's static
  6. For Certificate ARN, choose the certificate ARN for your private certificate.
  7. (Optional) For Device, enter a device name.
  8. Choose Create Customer Gateway.

Configure the Site-to-Site VPN

Configure the Site-to-Site VPN connection and associate it with a virtual private gateway or transit gateway, depending on your network architecture. For more information, see Create a target gateway.

Copy certificates to the customer gateway device

Export the following certificates from ACM, and then import them to the customer gateway device:

  • Private certificate
  • Subordinate CA certificate
  • Root CA certificate

Note: When the AWS VPN requests a certificate for authentication, the customer gateway device presents the private certificate. However, the customer gateway device must have all three certificates available. If any certificate is missing, then VPN authentication fails.

Related information

AWS Site-to-Site VPN customer gateway devices

Private certificate from AWS Private Certificate Authority

4 Comments

I see that an IP address is not required for the customer gateway in this setup. Does this mean that a connection can be made where the client is behind CGNAT? I need a site-to-site VPN from AWS VPN to a remote location where that remote location is using a cellular internet connection that uses CGNAT and isn't publicly addressable.

replied 3 years ago

Thank you for your comment. We'll review and update the Knowledge Center article as needed.

AWS
EXPERT

replied 3 years ago

Is it possible to use an external self-signed certificate for the Site-to-Site (S2S) VPN connection?

replied 3 years ago

Thank you for your comment. We'll review and update the Knowledge Center article as needed.

AWS
MODERATOR

replied 3 years ago

Relevant content