How do I create a certificate-based VPN using AWS Site-to-Site VPN?
I want to build a certificate-based IP Security (IPSec) VPN using AWS Site-to-Site VPN. How can I do this?
"I want to build a certificate-based IP Security (IPSec) VPN using AWS Site-to-Site VPN. How can I do this?Short descriptionAWS Site-to-Site VPN supports certificate-based authentication by integrating withAWS Certificate Manager Private Certificate Authority. Using digital certificates instead of pre-shared keys for IKE authentication, you can build IPSec tunnels with static or dynamic customer gateway IP addresses.ResolutionTask 1: Create and install a root CA and a subordinate CAThe private certificate you'll create in task 2 must be issued by the subordinate CA. The subordinate CA must be in AWS Certificate Manager (ACM). If your CA is not in ACM, you can create a Certificate Signing Request (CSR) and import the signed subordinate CA into ACM.Task 2: Create a private certificate to use as the identity certificate for your customer gateway****Note: You'll install this certificate in task 5.Task 3: Create a customer gateway for your VPN connectionOpen the Amazon Virtual Private Cloud (Amazon VPC) console.Choose Customer Gateways, and then choose Create Customer Gateway.For Name, specify a name for your customer gateway.For Routing, select the routing type for your use case.Leave the IP Address field empty if your customer gateway IP address is dynamic. If your customer gateway IP address is static, you can leave this field empty, or you can specify the IP address.For Certificate ARN, choose the certificate ARN that you created in task 2.(Optional) For Device, specify a device name.Choose Create Customer Gateway.Task 4: Configure the AWS Site-to-Site VPN connection with a virtual private gatewayTask 5: Copy the end entity certificate (the private certificate that you created in task 2), root CA certificate, and subordinate CA certificate to the customer gateway deviceNote: The customer gateway presents the end entity certificate when requested by the AWS VPN endpoint for authentication. The customer gateway device must have all the certificates present (subordinate CA certificate and root CA certificate). If the customer gateway device doesn't have these certificates, VPN authentication fails when the AWS VPN endpoint presents its own certificate.Related informationAWS Site-to-Site VPN now supports certificate authenticationFollow"