Proxied HTTPS calls using Kong 2 on AWS EC2 Kubernetes

[jason.hadlock]

We’re using kong v2.0 in an EC2 Kubernetes cluster (v1.14), and we want to proxy an https call from the internet, through the Kong pod running in the cluster, to a backend legacy webserver that lives behind the firewall but outside the Kubernetes cluster. SSL certificates are generated from the AWS Certificate Manager.

Client -> ELB (L4 passthru) -> Kong Kubernetes pod -> Legacy Webserver

We are having issues with securing all parts of the communication path with SSL. Specifically, we cannot get Kong to terminate TLS with an AWS public certificate.

Questions:

1. Is it possible to have Kong to use an AWS public certificate (when they disallow exporting the private key)?
2. If not, is it possible to terminate at the AWS load balancer with a public cert, protect the Kong Kubernetes pod with a private cert, and then have kong proxy the call to the legacy webserver (that has a valid public cert)?
3. Is there a better and/or standard configuration?

[hbagdi]

@jason.hadlock

Is it possible to have Kong to use an AWS public certificate (when they disallow exporting the private key)?

No. You need the private key to terminate TLS. You can use Let’s Encrypt to provision a certificate for your domain.

@jason.hadlock

If not, is it possible to terminate at the AWS load balancer with a public cert, protect the Kong Kubernetes pod with a private cert, and then have kong proxy the call to the legacy webserver (that has a valid public cert)?

Yes, that’s possible as well.