英文:
AWS API Gateway client certificates in Go lang
问题
我正在尝试按照文档中描述的方式,确保AWS API Gateway与我的API端点服务之间的连接安全。根据我所了解,我需要复制AWS API Gateway中的证书,并使用http.ListenAndServeTLS
方法。但是该方法需要两个文件:keyFile和certFile,即func ListenAndServeTLS(addr, certFile, keyFile string, handler Handler)
。
当我点击复制链接时(参见下面的图片),我得到的只是证书的格式(为了解释方便,我将其缩短了):
-----BEGIN CERTIFICATE-----
MIIC6TCCAdGgAwIBAgIJAKbyiCf2f5J2MA0GCSqGSIb3DQEBCwUAMDQxCzAJBgNV
fYe+dxR0PMFvfUpZaGgaY1ykQG1sNaw/b6NjNg9c1aEVSZ7b1eU/cBmb6XqHw0Ih
7yHtBm+p8Px4NMAT9YhytTxPRBYpApfUsfPMa3qfUWvvj4TD0LR6bW980bebyxUn
BigXToSFlPeiNGdU/Zpiw9crzplojNBFc=
-----END CERTIFICATE-----
所以,我的问题是,我需要如何配置ListenAndServeTLS
方法,以确保对我的服务的任何请求都来自API Gateway?我在哪里可以找到私钥?这对我来说相当困惑。
英文:
I'm trying to secure connection between AWS API Gateway and my API endpoint services exactly as it is described int his documentation: http://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html
AFAIK I need to copy the cert form AWS API Gateway and use http.ListenAndServeTLS
method. But it accepts two files: keyFile and certFile
func ListenAndServeTLS(addr, certFile, keyFile string, handler Handler)
.
When I click on copy link (see image below)
the only thing I get is the certificate in such format (I've shortened it for explanation purposes):
-----BEGIN CERTIFICATE-----
MIIC6TCCAdGgAwIBAgIJAKbyiCf2f5J2MA0GCSqGSIb3DQEBCwUAMDQxCzAJBgNV
fYe+dxR0PMFvfUpZaGgaY1ykQG1sNaw/b6NjNg9c1aEVSZ7b1eU/cBmb6XqHw0Ih
7yHtBm+p8Px4NMAT9YhytTxPRBYpApfUsfPMa3qfUWvvj4TD0LR6bW980bebyxUn
BigXToSFlPeiNGdU/Zpiw9crzplojNBFc=
-----END CERTIFICATE-----
So my question is, how exactly I need to configure ListenAndServeTLS
method to make sure the any request to my service is from API Gateway? Where I can find private key? It's quite confusing for me.
答案1
得分: 3
给你的AWS客户端证书用于验证发送请求到你的服务的客户端,也就是AWS网关。
这个证书不是用来启动你的服务器的,而是用来验证请求的身份。
以下是一个示例用法,未经测试的代码,仅供参考。
func Hello(w http.ResponseWriter, req *http.Request) {
io.WriteString(w, "hello, world!\n")
}
func main() {
http.HandleFunc("/hello", Hello)
certBytes, err := ioutil.ReadFile("aws-gateway.pem")
if err != nil {
log.Fatal(err)
}
block, certBytes := pem.Decode(certBytes)
cert, err := x509.ParseCertificate(block.Bytes)
if err != nil {
log.Fatal(err)
}
clientCertPool := x509.NewCertPool()
clientCertPool.AddCerts(cert)
tlsConfig := &tls.Config{
ClientCAs: clientCertPool,
// NoClientCert
// RequestClientCert
// RequireAnyClientCert
// VerifyClientCertIfGiven
// RequireAndVerifyClientCert
ClientAuth: tls.RequireAndVerifyClientCert,
}
tlsConfig.BuildNameToCertificate()
server := &http.Server{
Addr: ":8080",
TLSConfig: tlsConfig,
}
server.ListenAndServeTLS("server.crt", "server.key")
}
这样,你的服务将要求所有请求提供证书,并将其与ClientCA池进行验证。如果需要,你当然可以向客户端池中添加更多证书。
英文:
The client certificate AWS is given you is for authenticating the client that send requests to your service, which is the AWS gateway.
This cert is not to be used to start your server, but to authenticates requests.
See an example of use below, untested code, but as a lead.
func Hello(w http.ResponseWriter, req *http.Request) {
io.WriteString(w, "hello, world!\n")
}
func main() {
http.HandleFunc("/hello", Hello)
certBytes, err := ioutil.ReadFile("aws-gateway.pem")
if err != nil {
log.Fatal(err)
}
block, certBytes := pem.Decode(certBytes)
cert, err := x509.ParseCertificate(block.Bytes)
if err != nil {
log.Fatal(err)
}
clientCertPool := x509.NewCertPool()
clientCertPool.AddCerts(cert)
tlsConfig := &tls.Config{
ClientCAs: clientCertPool,
// NoClientCert
// RequestClientCert
// RequireAnyClientCert
// VerifyClientCertIfGiven
// RequireAndVerifyClientCert
ClientAuth: tls.RequireAndVerifyClientCert,
}
tlsConfig.BuildNameToCertificate()
server := &http.Server{
Addr: ":8080",
TLSConfig: tlsConfig,
}
server.ListenAndServeTLS("server.crt", "server.key")
}
This way, your service will require that all requests provide a certificate and will verify it against the pool of ClientCA. You could, of course, add more certificates to the client pool if desired.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论