# Ensure API Gateway SSL Enabled - Source: https://support.icompaas.com/support/solutions/articles/62000223585-ensure-api-gateway-ssl-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## **Description:** This policy checks if a REST API stage uses a Secure Sockets Layer (SSL) certificate. This rule is NON\_COMPLIANT if the REST API stage does not have an associated SSL certificate. You can use API Gateway to generate an SSL certificate and then use its public key in the backend to verify that HTTP requests to your backend system are from API Gateway. ## **Rationale:**  The SSL certificates that are generated by API Gateway are self-signed, and only the public key of a certificate is visible in the API Gateway console or through the APIs. ## **Impact:**   This allows your HTTP backend to control and accept only requests that originate from Amazon API Gateway, even if the backend is publicly accessible. ## **Default Value:**  By default, the API Gateway server is configured with a self-signed certificate and it is recommended to change to CA-signed certificate ### **Pre-requisites:**  AWS Identity and Access Management (IAM) user with administrator permissions and use that for all work that does not require root credentials. Create a password for console access, and access keys to use command line tools ## **Remediation:** ## **Test plan:** 1. Login to AWS management console 2. Go to API Gateway dashboard at [https://console.aws.amazon.com/apigateway/](https://console.aws.amazon.com/apigateway/). 3. In the left panel, select **APIs** to open the APIs listing page![](https://support.icompaas.com/assets/kb/16e8b1c12ab1b7c3.png) 4. In the navigation panel, inside the API submenu, click **Stages** to list the stages created for the selected API.![](https://support.icompaas.com/assets/kb/c5efb8e89cad136c.png) 5. Under **Stages**, choose the API stage that you want to examine, then select the **Settings** tab from the dashboard top panel![](https://support.icompaas.com/assets/kb/c699f609ad93ecc8.png) 6. On the **Settings** panel, in the **Client Certificate** section, check the **Certificate** dropdown list for any entries. ![](https://support.icompaas.com/assets/kb/500bbf3e20f38e43.png)  7. If there are no SSL certificates available in the **Certificate** list, the selected Amazon API Gateway then API stage is not using client-side SSL certificates for HTTP requests authentication. **Using AWS CLI:** 1. Run get-stages command (OSX/Linux/UNIX) using the name of the API stage that you want to examine as identifier and custom query filters to return the ID of the SSL certificate attached to the selected API stage: 2. aws apigateway get-stages --region --rest-api-id abcdabcdab --query 'item\[?(stageName==\`Staging\`)\].clientCertificateId' ## **Implementation steps:** 1. Sign in to AWS Management Console. 2. Navigate to API Gateway dashboard at [https://console.aws.amazon.com/apigateway/](https://console.aws.amazon.com/apigateway/). 3. In the left  panel, click on **Client Certificates** to access the SSL certificates page.![](https://support.icompaas.com/assets/kb/3744a1970b59ad3c.png) 4. Click **Generate Client Certificate** button from the dashboard to create a new client-side SSL certificate.![](https://support.icompaas.com/assets/kb/614c5064e6a4f9f9.png) 5. (Optional) Click the **Edit** link and add a descriptive title for the generated certificate within the **Description** box, then click **Save** to apply the changes. 6. Go back to the navigation panel and select **APIs** to open the APIs listing page. 7.  Choose the API that you want to reconfigure, then click on its name to access the API configuration. 8. In the navigation panel, inside the API submenu, click **Stages** to list the stages available for the selected API. 9. Under **Stages**, choose the API stage that you want to update and select the **Settings** tab to access the stage configuration panel.![](https://support.icompaas.com/assets/kb/2c4f246c42260b49.png) 10. In the **Client Certificate** section, select the name/ID of the SSL certificate created earlier in the process from the **Certificate** dropdown list, then click **Save Changes** to attach your new client-side SSL certificate to the selected API stage. Note that if the selected Amazon API Gateway API has been previously deployed, you will need to redeploy it for the changes to take effect. ![](https://support.icompaas.com/assets/kb/645f0dc7eec12d67.png) 11. Once the SSL certificate is successfully implemented, the AWS API Gateway service uses the certificate for all calls to HTTP integrations within your API. 12. Now you can [download](https://docs.aws.amazon.com/cli/latest/reference/apigateway/get-client-certificate.html) a copy of the newly created SSL certificate and [configure](https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html#certificate-validation) your backend servers and services to verify the client certificate. ## **Using AWS CLI:** aws apigateway update-stage --region --rest-api-id --stage-name '' --patch-operations op=replace,path=/clientCertificateId,value= 1. Run generate-client-certificate command (OSX/Linux/UNIX) to generate a new a client-side SSL certificate for Amazon API Gateway service: 2. \--region --description "SSL Certificate for HTTP requests authentication." 3. Run get-client-certificate command (OSX/Linux/UNIX) to extract thePEM-encoded public key of the SSL certificate created earlier in the process.The public key can be used to configure certificate authentication at theintegration endpoint level (e.g. servers level): 4. aws apigateway get-client-certificate --region --client-certificate-id abcabc --query "pemEncodedCertificate" ## ## **Backout Plan:**  1. Choose the API that you want to reconfigure, then click on its name to access the API configuration. 2. In the navigation panel, inside the API submenu, click Stages to list the stages available for the selected API. 3. Under Stages, choose the API stage that you want to update and select the Settings tab to access the stage configuration panel. 4. In the Client Certificate section, select None  5. To save the settings, choose Save Changes. If the API has been deployed previously in the API Gateway console, you'll need to redeploy it for the changes to take effect ## ****References :****  - **[](https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html)**[](https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html)[https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html)  - [Amazon API Gateway FAQs](https://aws.amazon.com/api-gateway/faqs/) - [Controlling Access to an API in API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html) - [Use Client-Side SSL Certificates for Authentication by the     Backend](https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.