1

I have a setup of API Gateway proxying all the requests to my EC2 instances behind load balancer (ALB). But I want api endpoint to have a nice domain my-api.mydomain.com. I'm trying to accomplish that via custom domains.

first step

Then I register Target Domain Name generated in Route53 like this

second step

and my http proxy setup is just a passthrough to the ALB which manages requests to underlying EC2 instances providing business logic.

third step

This setup doesn't work, so I'm wondering what's wrong with this configuration and what critical conceptual thing I have missed. Doing curl -SL https://my-api.mydomain.com/v1/records/ (or any api endpoint) throws {"message": "Internal server error"}. CloudWatch logs shows

Execution failed due to configuration error: Host name 'my-api-lb-111222333.us-east-1.elb.amazonaws.com' does not match the certificate subject provided by the peer (CN=*.mydomain.com)

I'd be grateful for any suggestions.

3
  • Can Cloud front go in front of api gateway
    – jdog
    Feb 27, 2020 at 7:21
  • @jdog yes, it can, but that wouldn't address the issue here, which is behind API Gateway. Wait... maybe you are one step ahead of me? CloudFront could be used instead of API Gateway for this setup, and it would not require a separate hostname on the backend if the HTTP host header is whitelisted for forwarding in the CloudFront Cache Behavior settings and the cert on the ALB matches the domain name pointed to the front side of CloudFront. That would also be cheaper if there's no need for API Gateway advanced capabilities ("http proxy setup is just a passthrough"). Hmmm. Feb 27, 2020 at 13:31
  • @Michael-sqlbot I only thought intuiatively the cert could sit on Cloudfront instead. Other thought I just had was a Network Load Balancer instead of ALB, but depends what exactly the ALB does
    – jdog
    Feb 27, 2020 at 23:45

1 Answer 1

2

Try directly accessing https://my-api-lb-111222333.us-east-1.elb.amazonaws.com from your web browser and you'll get a similar error. The SSL certificate is not just used for encryption -- it also verifies that the host is not an impostor, by being consulted in a check of whether the hostname used to access the target matches the hostname of the certificate that's offered by the target

Because amazonaws.com is not your domain, you can't get a certificate for that.

You need to assign a domain name from your domain to the ALB in DNS, e.g. origin.example.com, and point API Gateway to that name, not to the system-assigned hostname of the ALB.

1
  • yes, that worked, the only issue is that I have to create 2 DNS records in route53 - one for my custom api domain and the other one that is just an alias for alb. Thanks anyway Feb 27, 2020 at 13:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.