API client gateway cert when switch from Network LB to ALB

Question

My current architect is API Gateway (for a REST API), Network LB and EC2 servers in a EB environment. We use mTLS authentication at EC2 servers. The server stores API client gateway cert (created by AWS API Gateway console) and also SSL cert/key ( DigiCert) in its cert store.
Now I want to switch from Network LB to Application LB. This ALB will apply mTLS authentication and send just http trafic to EC2 servers.
I understand that now I need to move  API client gateway cert and SSL cert/keys into aws s3 store that will be used by ALB for mTLS.

My question is that can I use these current certs that are using for NLB architect and reuse them for the new architect ALB
Thanks

Merry · Accepted Answer

Yes, you can reuse your existing certificates when migrating from Network Load Balancer (NLB) to Application Load Balancer (ALB), but with important distinctions about which certificate and how they're used.

Your new architecture will be:
    API Gateway → ALB (with mTLS) → EC2 servers (HTTP only)
    ALB performs mTLS authentication using the Trust Store
    ALB terminates TLS and forwards plain HTTP to EC2 servers
    EC2 servers no longer need to store certificates

There two certificates in your scenario, working respectively for client authentication and for server authentication.

1. API Gateway Client Certificate (for mTLS client authentication)
Cannot be directly reused in the same way. Here's why:
--The API Gateway client certificate you created in the AWS API Gateway console is specifically for API Gateway to authenticate itself as a client when calling your backend
 --When you move mTLS authentication to ALB, you need to create an ALB Trust Store instead, which contains the CA certificate bundle that will verify client certificates
--The API Gateway client certificate itself would become a client certificate that ALB needs to verify, not something ALB uses directly

What you need to do:
--Extract the CA certificate (Certificate Authority) that signed your API Gateway client certificate
--Upload this CA certificate bundle to an S3 bucket
--Create an ALB Trust Store pointing to that S3 bucket location 
--Configure your ALB listener to use "verify with trust store" mode

2. DigiCert SSL Certificate/Key (for server authentication)
Yes, this can be reused. Your DigiCert server certificate and private key can be imported into AWS Certificate Manager (ACM) and used by ALB for the HTTPS listener.

Steps to reuse:
 --Import your DigiCert certificate into ACM (certificate body, private key, and certificate chain)
--When creating your ALB HTTPS listener, select this ACM certificate as the server certificate
--This handles the server-side TLS termination at the ALB

Taz · Answer

Hey,

Hope you're keeping well.

Yes, you can reuse your existing client certificates and SSL cert/key as long as they meet ALB’s requirements for mTLS. For ALB, the trust store must be uploaded to S3 in PEM format, and the bucket must be in the same account and Region as the ALB. The server certificate for ALB must be imported into AWS Certificate Manager or issued by ACM, so if your DigiCert cert is still valid, you can import it into ACM using the console or `aws acm import-certificate`. Just verify the certificate chain and ensure the client certs in S3 match the ones your API Gateway currently uses.

Thanks and regards,  
Taz

API client gateway cert when switch from Network LB to ALB

Add your answer

Relevant content