ALB and Istio mTLS Integration

ALB and Istio mTLS Integration An architecture diagram generated by Archify. Client · Client Cert · Architecture component Client Client Cert ALB · mTLS Termination · AWS · Trust Store · verify ALB mTLS Termination Trust Store · verify Istio Gateway · TLS (mode: SIMPLE) · AWS › EKS cluster · Istio mesh Istio Gateway TLS (mode: SIMPLE) Backend Service · Envoy mTLS · AWS › EKS cluster · Istio mesh Backend Service Envoy mTLS mTLS TLS mTLS AWS EKS cluster · Istio mesh Legend Backend Cloud Security External

ALB (Step 1)

  • • Register the CA certificate bundle as a Trust Store
  • • Verify client certificates with listener mutual-authentication Mode=verify

Istio Gateway (Step 3)

  • • tls.mode: SIMPLE because ALB already completed mTLS verification
  • • Server certificate supplied via credentialName: gateway-cert

Backend Service

  • • PeerAuthentication STRICT enforces mTLS between Envoy sidecars in the mesh