Server Load Balancer:Configure mutual authentication on an HTTPS listener

Procedure

In this example, a self-signed certificate authority (CA) certificate is used to sign the client certificate. To configure mutual authentication on the HTTPS listener, perform the following steps.

Prerequisites

• A CLB instance is created.

• Two Elastic Compute Service (ECS) instances that host different application services are created. In this example, the ECS instances are named ECS01 and ECS02.

Step 1: Purchase a server certificate

You can purchase a server certificate in the Certificate Management Service console or from another service provider. A browser authenticates the identity of a server by checking whether the certificate sent by the server is issued by a trusted CA.

Step 2: Generate a CA certificate by using OpenSSL

Log on to a Linux machine on which OpenSSL is installed.

1. Run the following commands to create a private key for the root CA certificate:

   openssl genrsa -out root.key 4096

2. Run the following command to create a certificate signing request (CSR):

   openssl req -new -out root.csr -key root.key

   Configure the other parameters. Examples:

   Note

   Make sure that the common name on the CA certificate is unique. The common name must be different from the common name on the client certificate or other server certificates.

   Country Name (2 letter code) [XX]:cn
   State or Province Name (full name) []:bj
   Locality Name (eg, city) [Default City]:bj
   Organization Name (eg, company) [Default Company Ltd]:alibaba
   Organizational Unit Name (eg, section) []:test
   Common Name (eg, your name or your servers hostname) []:root
   Email Address []:a.alibaba.com
   A challenge password []:
   An optional company name []:

3. Run the following command to create a root CA certificate:

   openssl x509 -req -in root.csr -out root.crt -signkey root.key -CAcreateserial -days 3650

   The following figure shows the result.

4. Run the Is command to query the root.crt root CA certificate file and the root.key private key file.

Step 3: Generate a client certificate

1. Run the following command to generate a private key for the client certificate:

openssl genrsa -out client.key 4096

2. Run the following command to generate a CSR for creating a client certificate. Set the common name to the domain name of your CLB instance.

openssl req -new -out client.csr -key client.key

3. Run the following commands to view the generated client certificate:

openssl x509 -req -in client.csr -out client.crt -signkey client.key -CA root.crt -CAkey root.key -CAcreateserial -days 3650

4. Run the following command to convert the client.crt client certificate file to a PKCS12 file that is recognizable by browsers. Enter a password that is used to encrypt the private key of the client certificate.

openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12

5. Run the Is command to query the client.key, client.crt, and client.p12 client certificate files.

Step 4: Install the client certificate

Install the generated client certificate on the client.

Step 5: Upload the server certificate and the CA certificate

1. Log on to the CLB console.

2. In the left-side navigation pane, choose CLB > Certificates, click Add Certificate, and then upload the server certificate.

3. In the Add Certificate panel, select Third-party Certificates, configure the parameters of the certificate, and then click Create.

   Parameter	Description
   Certificate Name	Enter a name for the certificate.
   Certificate Type	In this example, Server Certificate is selected.
   Public Key Certificate	Paste the content of the server certificate into the editor.
   Private Key	Paste the private key of the server certificate into the editor.
   Region	Select the region of the CLB instance.

4. On the Certificates page, click Add Certificate to upload the CA certificate.

5. In the Add Certificate panel, click Third-party Certificates, configure the parameters, and then click Create.

   Parameter	Description
   Certificate Name	Enter a name for the certificate.
   Certificate Type	In this example, CA Certificate is selected.
   Client CA Certificate	Upload the public key certificate of the client.
   Region	Select the region of the CLB instance.

Step 6: Configure mutual authentication on an HTTPS listener

1. Log on to the CLB console.

2. Click the ID of the CLB instance that you want to manage.

3. On the Listener tab, click Add Listener.

4. In the Protocol & Listener step, configure the parameters and click Next.

   • Select Listener Protocol: In this example, HTTPS is selected.

   • Listener Port: In this example, port 443 is selected.

5. In the Certificate Management Service step, select the server certificate that you uploaded.

6. Click Modify to the right of Advanced Settings, turn on Mutual Authentication, select the CA certificate that you uploaded, and then click Next.

7. Select Default Server Group and click Add More to add backend servers.

8. Use the default values for other parameters, click Next, and then click Submit.

Step 7: Test whether mutual authentication works as expected

sudo curl --cert /home/ca/client.crt --key /home/ca/client.key --cacert /home/ca/ca.crt https://<The domain name associated with the server certificate>:<port>