Securing traffic with ACM Private Certificate Authority
Tags: aws, openssl, cloudformation, nginx
Published: 2020-02-17 14:49:20

## Overview
Configuring applications to remain unencrypted poses several security risks as user data traverses over networks in cleartext. Although it is widely accepted for utilizing https over the public internet, in most cases configured at the load balancer, configuring internal SSL communication is just as critical as you look to harden your systems, and drive toward a zero-trust network. Utilizing an internal Certificate Authority (CA), rather it be root or subordinate, can help you validate and certify your internal communication.

#### Utilizing LoadBalancer Termination
Despite being able to set TLS encryption at the load balancer, utilizing unencrypted traffic to the application tier still poses a risk. To display this, create a load balancer which targets an HTTP web app. For this example, I created a simple app fleet that just returns a 200 on any post.

![load balancer and host infra](https://prod.tournamentmgr.com/images/blogs/securing+backend/basic+loadbalancer+infrastructure.png)

Once set up, send a POST to the app server, while running tcpdump.

`curl -X POST -d '{"data": "unencrypted" }' https://test.example.com`

![HTTP Packet Trace](https://prod.tournamentmgr.com/images/blogs/securing+backend/http_packet_capture.png)

As you can see, the body is visible, and despite the certain network protections AWS provides within your VPC, technologies such as traffic mirroring, or application vulnerabilities such as command injection, could put you at risk of more than just your application seeing this data.

However, utilizing an encrypted backend this would not be the case:

`curl -X POST -d '{"data": "unencrypted" }' https://test.example.com`

![HTTPS Packet Trace](https://prod.tournamentmgr.com/images/blogs/securing+backend/https_packet_capture.png)

#### Host to Host Communication
In other cases where load balancers are not involved, there may be use cases where your servers have to speak directly to each other. Once your web applications have their signed certificate from a private CA, it is as simple as adding that CA to the host trust, which will allow you to enforce validation when sending data. 

## Implementation
This example will define how to certify Nginx, however, a majority of these steps can easily be modified to whatever framework you are utilizing. 

_Note: The CA infrastructure will be built with Cloudformation, although AWS CLI commands will also work. At the time of writing, this is not available to do directly with native terraform resources: <a href="https://github.com/terraform-providers/terraform-provider-aws/issues/5552">See Issue</a>_

Create a Private CA with ec2.internal domain or with your own internal host domain.
{% gist https://gist.github.com/danquack/6c3dcfedc72604a27ec64240ac634363 file=root_ca.yml %}

Create a certificate and activate the CA.
{% gist https://gist.github.com/danquack/6c3dcfedc72604a27ec64240ac634363 file=root_cert.yml %}

Utilize openssl to generate a key and csr.
{% gist https://gist.github.com/danquack/6c3dcfedc72604a27ec64240ac634363 file=create_cert.sh %}

Utilize issue-certificate and get-certififace acm-pca api calls to obtain the ssl_certifacte you will need to secure your internal domain. You will need the root CA ARN from created above.
{% gist https://gist.github.com/danquack/6c3dcfedc72604a27ec64240ac634363 file=sign_cert.sh %}

Update Nginx, security groups, load balancer target groups, and/or hosts to listen and communicate with SSL.

#### Nginx
{% gist https://gist.github.com/danquack/6c3dcfedc72604a27ec64240ac634363 file=nginx.conf %}

#### Security groups
{% gist https://gist.github.com/danquack/6c3dcfedc72604a27ec64240ac634363 file=sg.yaml %}

#### Target Groups
{% gist https://gist.github.com/danquack/6c3dcfedc72604a27ec64240ac634363 file=target_group.yaml %}

#### Host
_The following process will vary per Operating system. You should see this a guidance, but defer to your OS documentation for how to update the trust._

{% gist https://gist.github.com/danquack/6c3dcfedc72604a27ec64240ac634363 file=host_ca.sh %}