AWS API Gateway as an http proxy to ALB

Question

I have a setup of API Gateway proxying all the requests to my EC2 instances behind load balancer (ALB). But I want api endpoint to have a nice domain my-api.mydomain.com. I'm trying to accomplish that via custom domains.

Then I register Target Domain Name generated in Route53 like this

and my http proxy setup is just a passthrough to the ALB which manages requests to underlying EC2 instances providing business logic.

This setup doesn't work, so I'm wondering what's wrong with this configuration and what critical conceptual thing I have missed. Doing curl -SL https://my-api.mydomain.com/v1/records/ (or any api endpoint) throws {"message": "Internal server error"}. CloudWatch logs shows

Execution failed due to configuration error: Host name 'my-api-lb-111222333.us-east-1.elb.amazonaws.com' does not match the certificate subject provided by the peer (CN=*.mydomain.com)

I'd be grateful for any suggestions.

Answer 1

Try directly accessing https://my-api-lb-111222333.us-east-1.elb.amazonaws.com from your web browser and you'll get a similar error. The SSL certificate is not just used for encryption -- it also verifies that the host is not an impostor, by being consulted in a check of whether the hostname used to access the target matches the hostname of the certificate that's offered by the target

Because amazonaws.com is not your domain, you can't get a certificate for that.

You need to assign a domain name from your domain to the ALB in DNS, e.g. origin.example.com, and point API Gateway to that name, not to the system-assigned hostname of the ALB.