AWS Application Load Balancer now supports mutually authenticating clients using X.509 certificates, allowing only trusted clients to communicate with backend applications while offloading the authentication to the load balancer.

<div>
<p>The article introduces mutual authentication for Application Load Balancer (ALB), which allows ALB to reliably verify certificate-based client identities. This new feature enables offloading client authentication to the load balancer, ensuring only trusted clients communicate with backend applications.</p>
<p>Specifically, the article covers:</p>
<ul>
<li>What is mutual authentication (mTLS) and its use cases, such as B2B applications and online services</li>
<li>How to enable and configure mutual authentication on ALB, including trust store setup with CA bundles and certificate revocation lists</li>
<li>Two mutual authentication options: Passthrough (sending client certificate chains to backend) and Verify with trust store (ALB verifying client certificates)</li>
<li>Using AWS CLI to create trust stores and configure mTLS on ALB</li>
<li>Testing mTLS on ALB with self-signed certificates and curl</li>
<li>Availability and pricing information</li>
</ul>
</div>


Mutual authentication for Application Load Balancer reliably verifies certificate-based client identities

Related articles