Obtain a publicly trusted TLS certificate

AWS requires a domain name and a publicly trusted TLS certificate for the key store. The TLS certificate must be issued by a public certificate authority supported for external key stores. For a list of certificate authorities, see https://github.com/aws/awskms-xksproxy-api-spec/blob/main/TrustedCertificateAuthorities.

Public domain name

Because the nShield XKS proxy EC2 is fronted by an NLB, the hostname should resolve to the NLB rather than directly to the EC2 instance.

Create a DNS record for the CN pointing to the NLB DNS name. This is the same CN specified in VPC Endpoint Service.

For example:

nshield-xks.entrust.com -> nshield-xks-99c54d711bcb6315.elb.us-east-1.amazonaws.com

Publicly trusted TLS certificate

  1. On the EC2 instance, generate and save a 4096-bit RSA private key.

    For example:

    $ openssl genrsa -out nshield-xks-private.key 4096

ls -al nshield-xks-private.key
-rw-------. 1 ec2-user ec2-user 3268 Jul  9 13:31 nshield-xks-private.key

  2. Create a certificate signing request (CSR) using the key.

    Use the same CN specified in VPC Endpoint Service.

    For example:

    $ openssl req -new -key nshield-xks-private.key -out nshield-xks-private.pem
...

    You can view the CSR with the following command.

    $ openssl req -text -noout -verify -in nshield-xks-private.pem
...

  3. Submit the CSR above to a trusted public certificate authority and obtain a signed certificate.

DNS TXT record for AWS PrivateLink domain verification

Create a public DNS record for AWS PrivateLink domain verification as follows:

Parameter Value

Record name

Service endpoint Domain verification name

Type

Service endpoint Domain verification type

Value

Service endpoint Domain verification value

Verify the endpoint service domain

After the records have been created and resolve successfully (you can test this using nslookup) and the TLS certificate has been issued, you should verify the endpoint service domain.

  1. In your endpoint, select Actions > Verify domain ownership for private DNS name.

  2. When prompted to confirm the action, enter verify.

    The status should be Verified.