Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

API Gateway connect to ALB got error Client TLS Negotiation error

0

I'm having an HTTP APIs APIGW and want to integrate it to my ALB. My internal ALB have rule listening on port 443 and currently have security policy with a Private ACM certificate. In the integration of the ALB, I have set the integration to ALB through VPC Link with target is ALB listener HTTPS 443 and also set the advanced settings for Secure server name is the DNS name for the ALB, which is also the DNS name for the private ACM certificate of ALB. But when I call the APIGW, I got error 500 - Internal Server and when check the metric of ALB, I see metric error for Client TLS Negotiation error. How can I fix this error?

Topics
ServerlessFront-End Web & MobileSecurity, Identity, & ComplianceNetworking & Content Delivery
Tags
AWS Private Certificate AuthorityAWS Certificate ManagerAmazon API GatewayElastic Load Balancing
Language
English
asked 10 months ago305 views
1 Answer
0

The issue you're experiencing with the 500 Internal Server error and Client TLS Negotiation errors in your ALB metrics is likely related to the TLS handshake between the API Gateway and your internal ALB. The TLS negotiation errors between API Gateway and ALB can be resolved through several steps. First, check the SSL cipher and protocol fields in the ALB logs to verify if there is a mismatch between the client and ALB configurations . You can examine the ALB's SSL cipher and protocol settings by using the describe-load-balancers or describe-listeners AWS CLI commands . A solution is to create a certificate that includes subjectAlternativeNames for both your API Gateway and ALB . The API Gateway should be given a Custom Domain that matches an alternative name of this certificate. For the ALB, it must listen on port 443 with TLS enabled using the same certificate . Additionally, ensure that the certificate validation status shows "Success" and hasn't expired . If you're still experiencing issues, verify that the ALB's security policy is appropriate - you may need to update to a secure TLS policy like "ELBSecurityPolicy-TLS-1-2-2017-01" . Be aware that updating TLS policies might cause compatibility issues with older clients and could introduce some performance overhead .

answered 10 months ago
  • Nguyen Tien Dat
    10 months ago

    Hi, thank you for answering. The security policy is currently ELBSecurityPolicy-TLS-1-2-2017-01, but I think the issue is the certificate type is Private and is signed by AWS Private CA. Is there anyway for APIGW to verify this cert?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content