Application Load Balancer now supports Mutual TLS, enabling authentication of clients using X.509 certificates while establishing TLS encrypted connections, enhancing security for your applications.

<div>
<p>This article introduces Mutual TLS support for Amazon's Application Load Balancer (ALB), allowing authentication of clients using X.509 certificates during TLS encrypted connections.</p>
<p>Specifically, the article covers:</p>
<ul>
<li>Two options for client certificate validation: passthrough mode (sends client certificate chain to target application) or verify mode (offloads authentication to ALB)</li>
<li>Support for client certificates from third-party CAs or AWS Private Certificate Authority (PCA)</li>
<li>Optional revocation checks for compromised client certificates</li>
<li>Configuration via AWS APIs or Management Console, including creating a Trust Store resource for verify mode</li>
<li>Availability in all commercial AWS regions and GovCloud</li>
<li>Pricing details and links to further documentation</li>
</ul>
</div>


Application Load Balancer can authenticate X.509 certificate based identities with Mutual TLS support

Related articles