I am trying to access a secured WAS URL via the Secure Gateway. I can access an unsecured page via HTTP. When I set the Secure Gateway Destination to HTTPS and try to access the secured page (requires a userid/password), the connection fails.
Last year I was told that HTTPS was not supported. However, I think that I just don't know how to configure the Secure Gateway to do it now.
In order for HTTPS to be in use on both sides of the connection (app to Secure Gateway Server, and Secure Gateway Client to on-premises resource), the protocol should be HTTPS (which it sounds like you have) and you should also enable Destination-side TLS under the Advanced options panel of the destination. This will cause the connection being made from the Secure Gateway Client to the on-premises resource to be HTTPS rather than HTTP.
Related
I cannot for the life of me get the AWS API Gateway HTTP Proxy to work, i.e. redirect http://<my-domain>.com to https://<my-domain>.com. Here is how I set it up:
Using the Test functionality on the ANY method inside the resource works. But if I simply do curl http://<my-domain>.com or run http://<my-domain>.com in Chrome, it fails to connect; https://<my-website>.com works just fine. I'm driving myself crazy trying to figure out what I'm missing here; it seems like it should just redirect http://<my-domain>.com to https://<my-domain>.com, but it doesn't (even on different devices).
So, it turns out that API Gateway's HTTP Proxy allows HTTPS traffic to go to an HTTP endpoint, but not the reverse. In fact, API Gateway won't even establish a connection on port 80; from the FAQ:
Q: Can I create HTTPS endpoints?
Yes, all of the APIs created with Amazon API Gateway expose HTTPS
endpoints only. Amazon API Gateway does not support unencrypted (HTTP)
endpoints.
API Gateway doesn't support unencrypted HTTP traffic. Here are the possible options you can do to secure your website:
If you have access to the server that hosts the website, install an SSL certificate to the webserver.
If the website is hosted on EC2, you can set up a load balancer and let it do the SSL termination.
I want to speed up access to wso2is PDP with changing from https to http.
All interactions occurs inside of seured network, so there is no security limitations.
I can't setup wso2is so, that PDP endpoint do not to redirect all requests from http to https port.
Is it possible? Can anybody help me with this quest?
We have a supplier provided REST API that doesn't support HTTPS (only HTTP). Is there a way to secure the outbound REST PUTs (to AWS) using HTTPS? We were considering using STunnel but this doesn't meet our internal InfoSec requirements. Would it be possible to put an IIS reverse proxy in and secure the outbound traffic from there?
I've added certificate with custom domain name map in AWS API gateway but it allows HTTP automatically, how can I block normal HTTP and only allows HTTPS?
All API Gateway APIs are fronted with a CloudFront distribution. Each of these CloudFront distributions (whether it's a Custom Domain like yours or the default *.execute-api distribution) is configured to redirect all HTTP requests to HTTPS. Although CloudFront has the option to strictly require HTTPS and return 403 on HTTP requests we currently don't expose this option for simplicity.
If you feel you have valid use case for requiring HTTPS without a redirect please open a support ticket and the team can evaluate your request.
I have some APIs on my laptop. They are visible on the internet through secure gateway service.
The secure gateway destination is configured with TLS mutual authentication option. So APIs require TLS mutual authentication.
I would like to add those APIs to API Management.
I could not bind a SSL profile on Proxy tab, but I could bind a SSL profile to an HTTP GET operation on Implementation tab.
Does this mean I have to implement an assembly operation to bind a SSL profile?
The "Proxy" tab is meant as a "simple" get you going proxy setup. For more advanced "proxies", you should use an "Assembly" implementation with a "Proxy" policy. On the settings for the Proxy policy you can specify an SSL profile.