Deploy HTTPS mutual authentication through ALB Ingress

How it works

The server uses its root CA certificate to verify the client certificate before establishing the connection.

Prerequisites

Ensure that you have:

• An SSL or TLS certificate is configured on the ALB listener.

• A root CA certificate obtained by either:

  • Purchasing a private CA in Certificate Management Service

  • Generating a self-signed CA certificate

(Optional) Step 1: Generate a self-signed CA certificate

Skip this step if you already have a root CA certificate.

1. Generate a private key:

   openssl genrsa -out ca.key 4096

2. Create a certificate signing request (CSR):

   Field	Required	Description
   Country Name	Yes	Two-letter country code, for example, cn
   State or Province Name	Yes	Province or region name
   Locality Name	Yes	City name
   Organization Name	Yes	Organization name
   Organizational Unit Name	Yes	Department name
   Common Name	No	A commonly used name
   Email Address	No	Certificate administrator email
   A challenge password	No	Optional CSR security password. Leave blank if not needed

   openssl req -new -out ca.csr -key ca.key

   OpenSSL prompts for the following fields:

   Country Name (2 letter code) [XX]:cn
   State or Province Name (full name) []:bj
   Locality Name (eg, city) [Default City]:bj
   Organization Name (eg, company) [Default Company Ltd]:alibaba
   Organizational Unit Name (eg, section) []:test
   Common Name (eg, your name or your servers hostname) []:root
   Email Address []:example@ali
   A challenge password []:

3. Create the root CA certificate with a validity of 3,650 days:

   File	Description
   ca.crt	Root CA certificate
   ca.csr	CSR file
   ca.key	Private key

   openssl x509 -req -in ca.csr -out ca.crt -signkey ca.key -CAcreateserial -days 3650

   Run ls to confirm the output files:

   ca.crt  ca.csr  ca.key

Step 2: Upload the CA certificate

Upload the root CA certificate to Certificate Management Service to obtain a certificate identifier for the AlbConfig.

1. Log on to the Certificate Management Service console. Select the Outside Chinese Mainland region. In the left navigation pane, click Certificate Application Repository.

2. On the Certificate Application Repository page, click Create Repository. In the Create Repository panel, set the following parameters and click OK.

   Parameter	Description
   Repository Name	Custom repository name
   Data Source	Select Upload CA Certificates to upload certificates signed by third-party CAs

3. Click your repository, then click Uploaded Certificates.

4. In the CA Information panel, fill in the following fields and click Confirm and Enable.

   Parameter	Description
   Package Name	Custom certificate name
   CA Certificates	Paste the certificate content, or click Upload and Parse File

5. Click Details for the uploaded certificate and record the certificate identifier for Step 4.

Step 3: Generate a client certificate

Use the root CA certificate to sign a client certificate.

1. Generate a private key for the client:

   openssl genrsa -out client.key 4096

2. Create a CSR for the client certificate:

   openssl req -new -out client.csr -key client.key

   Complete the same fields as Step 1. Values can differ from the CA certificate.

3. Sign the client certificate using the root CA:

   File	Description
   client.crt	Client certificate signed by the root CA
   client.csr	CSR file
   client.key	Client private key

   openssl x509 -req -in client.csr -out client.crt -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650

   ca.crt and ca.key are from Step 1. Run ls to confirm the output:

   client.crt  client.csr  client.key

Step 4: Enable and test mutual authentication

(Optional) Step 5: Disable mutual authentication

1. Open the AlbConfig for editing:

   kubectl edit albconfig <ALBCONFIG_NAME>

2. Set caEnabled to false:

   apiVersion: alibabacloud.com/v1
   kind: AlbConfig
   metadata:
     name: #...
   spec:
     config:
       #...
     listeners:
     - port: 443
       protocol: HTTPS
       caEnabled: false                                       # Disable mutual authentication
       caCertificates:
       - CertificateId: 0e40dda998174723af39d37fcaf*****
       certificates:
         #...

Next steps

• Use a QUIC listener to support HTTP/3.

• Use WAF-enabled ALB instances to protect applications.