Rule: API Gateway Stage Should Use SSL Certificate

The following rule mandates that all API Gateway stages should use an SSL (Secure Sockets Layer) certificate for CISA (Cybersecurity and Infrastructure Security Agency) Cyber Essentials compliance. This is an important security measure to protect the data transmitted between clients and the API Gateway endpoint.

Using an SSL certificate ensures that the communication between the client and the API Gateway is encrypted and secure. By enabling SSL, sensitive information, such as user credentials and data, remains protected from unauthorized access or interception by malicious actors. Complying with CISA-Cyber Essentials guidelines ensures a higher level of security and minimizes potential vulnerabilities.

• Obtain a valid SSL certificate from a trusted certificate authority (CA) or from Amazon Certificate Manager (ACM). Ensure that the certificate is compatible with the API Gateway stage.

• If you are using ACM, follow these steps to import the SSL certificate:

  2. 1.
     Log in to the AWS Management Console.
  4. 2.
     Navigate to the ACM service.
  6. 3.
     Click "Import a certificate."
  8. 4.
     Follow the on-screen instructions to import the SSL certificate.

• To associate the SSL certificate with the API Gateway stage, follow these steps:

  2. 1.
     Log in to the AWS Management Console.
  4. 2.
     Navigate to the API Gateway service.
  6. 3.
     Select the desired API Gateway stage.
  8. 4.
     Go to the "Settings" tab.
  10. 5.
      Under the "Custom domain name" section, choose the desired domain name.
  12. 6.
      Select the imported SSL certificate from either ACM or the CA.
  14. 7.
      Save the changes.

• After associating the SSL certificate, perform the following steps to verify the SSL certificate configuration:

  2. 1.
     Open a web browser and enter the custom domain name linked to the API Gateway stage.
  4. 2.
     If the SSL certificate has been configured correctly, the browser should display a lock icon indicating a secure connection.
  6. 3.
     Perform a thorough testing of the API Gateway endpoints to ensure SSL is properly functioning.

• Ensure the SSL certificate chain is properly configured:

  • If using ACM, check if the certificate chain is intact and all intermediate certificates are correctly linked.
  • If using a CA certificate, verify the certificate chain with the CA's documentation.

• Confirm that the SSL certificate is not expired. If it has expired, obtain and configure a new SSL certificate.

• Verify that the custom domain name is correctly mapped to the API Gateway using the appropriate DNS settings.