I am configuring mTLS for an API Gateway, my trustore.pem only has one cert.

I've created another CA, signed a cert with that CA and issued the curl request with --key and --cert params, and it went through. I already disabled the default endpoint.

I am wondering if this is the expected behaviour, its not safe, its just bollocks cause anyone can create a self-signed cert and bypass the mTLS.

What I did:

# ca
openssl genrsa -out RootCA.key 4096
openssl req -new -x509 -days 3650 -key RootCA.key -out RootCA.pem



# client john
openssl genrsa -out john.key 2048
openssl req -new -key john.key -out john.csr
openssl x509 -req -in john.csr -CA RootCA.pem -CAkey RootCA.key -set_serial 01 -out john.pem -days 3650 -sha256

# create trustore (copy of RootCA.pem) and upload it to S3.
cp RootCA.pem truststore.pem
aws s3 cp truststore.pem s3://...

If I issue:

curl --cert john.csr --key john.key myapi/test
healthy

But if I create another CA

# ca
openssl genrsa -out RootCA-2.key 4096
openssl req -new -x509 -days 3650 -key RootCA-2.key -out RootCA-2.pem



# client marta
openssl genrsa -out marta.key 2048
openssl req -new -key marta.key -out marta.csr
openssl x509 -req -in marta.csr -CA RootCA-2.pem -CAkey RootCA-2.key -set_serial 01 -out marta.pem -days 3650 -sha256

And issue

curl --cert marta.csr --key marta.key myapi/test
healthy

It responds with healthy which should deny the request cause the RootCA-2 is not on the truststore, right?

I am configuring mTLS for an API Gateway, my trustore.pem only has one cert.

I've created another CA, signed a cert with that CA and issued the curl request with --key and --cert params, and it went through. I already disabled the default endpoint.

I am wondering if this is the expected behaviour, its not safe, its just bollocks cause anyone can create a self-signed cert and bypass the mTLS.

What I did:

# ca
openssl genrsa -out RootCA.key 4096
openssl req -new -x509 -days 3650 -key RootCA.key -out RootCA.pem



# client john
openssl genrsa -out john.key 2048
openssl req -new -key john.key -out john.csr
openssl x509 -req -in john.csr -CA RootCA.pem -CAkey RootCA.key -set_serial 01 -out john.pem -days 3650 -sha256

# create trustore (copy of RootCA.pem) and upload it to S3.
cp RootCA.pem truststore.pem
aws s3 cp truststore.pem s3://...

If I issue:

curl --cert john.csr --key john.key myapi/test
healthy

But if I create another CA

# ca
openssl genrsa -out RootCA-2.key 4096
openssl req -new -x509 -days 3650 -key RootCA-2.key -out RootCA-2.pem



# client marta
openssl genrsa -out marta.key 2048
openssl req -new -key marta.key -out marta.csr
openssl x509 -req -in marta.csr -CA RootCA-2.pem -CAkey RootCA-2.key -set_serial 01 -out marta.pem -days 3650 -sha256

And issue

curl --cert marta.csr --key marta.key myapi/test
healthy

It responds with healthy which should deny the request cause the RootCA-2 is not on the truststore, right?

• amazon-web-services
• aws-api-gateway
• mtls

1 Answer 1

I was issuing /ping whereas /ping and /sping are reserved endpoints for api gateway, thus always anwsering with healthy...

Attacking any other endpoint works good, segregating by certs and allowing/denying if a cert comes from trusted CA.