CODEWITHSUNDEEP
amazon-web-servicesaws-api-gatewayamazon-ecsamazon-route53
L.H.
L.H.

Reputation: 81

Matching certificate for VPC-Link HTTPS endpoint in API Gateway

I would like to change my API from HTTP to HTTPs in API Gateway, but get the following error: 

Endpoint request headers: {x-amzn-apigateway-api-id=ghqsfz8w25, 
Accept=application/json, User-Agent=AmazonAPIGateway_xxxx, 
Host=xxx-nlb-ecs-service-xxx-xxxcea41.elb.eu-west-1.amazonaws.com, 
X-Amzn-Trace-Id=Root=1-xxx-xxx}
Endpoint request body after transformations: 
Sending request to https://xxx-nlb-ecs-service-xxx-xxxcea41.elb.eu-west-1.amazonaws.com
Execution failed due to configuration error: 
Host name 'vpce-xxx007-xxxb1h.vpce-svc-xxx318ce.eu-west-1.vpce.amazonaws.com' does 
not match the certificate subject provided by the peer (CN=*.domain.eu)
Method completed with status: 500

With the following configuration:

The settings of the API method are

With HTTP this configuration was working. Now it seems that I need to associate the VPC endpoint with the wildcard certificate. It is my first experience with AWS and I am not a network expert. Any ideas how I can fix this issue.

Thanks in advance!

Upvotes: 8

Views: 6381

Answers (1)

antonmos
antonmos

Reputation: 1046

To make this work

  • Use ACM to provision a cert for a private zone you control, e.g. domain.eu
  • Create A-Alias record for the NLB, e.g. vpclink-nlb.domain.eu
  • Update the NLB listener to use the above cert
  • Update the API Gateway Method Integration Endpoint URL to https://vpclink-nlb.domain.eu

Upvotes: 4

Related Questions