<p>Try directly accessing <code>https://my-api-lb-111222333.us-east-1.elb.amazonaws.com</code> from your web browser and you'll get a similar error.  The SSL certificate is not just used for encryption -- it also verifies that the host is not an impostor, by being consulted in a check of whether the hostname used to access the target matches the hostname of the certificate that's offered by the target</p>

<p>Because amazonaws.com is not your domain, you can't get a certificate for that.</p>

<p>You need to assign a domain name from your domain to the ALB in DNS, e.g. <code>origin.example.com</code>, and point API Gateway to that name, not to the system-assigned hostname of the ALB. </p>

CC BY-SA 4.0
2020-02-27T13:11:28.983Z
yes, that worked, the only issue is that I have to create 2 DNS records in route53 - one for my custom api domain and the other one that is just an alias for alb. Thanks anyway
Most Wanted
CC BY-SA 4.0
2020-02-26T21:17:58.557Z
2020-02-26T21:17:58.557Z
Michael - sqlbot
<p>I have a setup of API Gateway proxying all the requests to my EC2 instances behind load balancer (ALB). But I want api endpoint to have a nice domain <code>my-api.mydomain.com</code>. I'm trying to accomplish that via <a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html" rel="nofollow noreferrer">custom domains</a>. </p>

<p><a href="https://i.sstatic.net/WloFq.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/WloFq.png" alt="first step"></a></p>

<p>Then I register <code>Target Domain Name</code> generated in Route53 like this</p>

<p><a href="https://i.sstatic.net/KM8Bt.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/KM8Bt.png" alt="second step"></a></p>

<p>and my http proxy setup is just a passthrough to the ALB which manages requests to underlying EC2 instances providing business logic.</p>

<p><a href="https://i.sstatic.net/34Z1M.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/34Z1M.png" alt="third step"></a></p>

<p>This setup doesn't work, so I'm wondering what's wrong with this configuration and what critical conceptual thing I have missed. Doing <code>curl -SL https://my-api.mydomain.com/v1/records/</code> (or any api endpoint) throws <code>{"message": "Internal server error"}</code>. CloudWatch logs shows </p>

<blockquote>
  <p>Execution failed due to configuration error: Host name
  'my-api-lb-111222333.us-east-1.elb.amazonaws.com' does not match the
  certificate subject provided by the peer (CN=*.mydomain.com)</p>
</blockquote>

<p>I'd be grateful for any suggestions.</p>

CC BY-SA 4.0
2020-02-27T07:21:11.913Z
Can Cloud front go in front of api gateway
jdog
CC BY-SA 4.0
2020-02-27T13:31:32.013Z
@jdog yes, it can, but that wouldn't address the issue here, which is behind API Gateway.   Wait... maybe you are one step ahead of me? CloudFront could be used *instead* of API Gateway for this setup, and it would not require a separate hostname on the backend if the HTTP `host` header is whitelisted for forwarding in the CloudFront Cache Behavior settings and the cert on the ALB matches the domain name pointed to the front side of CloudFront.  That would also be cheaper if there's no need for API Gateway advanced capabilities *("http proxy setup is just a passthrough")*.  Hmmm.
Michael - sqlbot
CC BY-SA 4.0
2020-02-27T23:45:13.487Z
@Michael-sqlbot I only thought intuiatively the cert could sit on Cloudfront instead. Other thought I just had was a Network Load Balancer instead of ALB, but depends what exactly the ALB does
jdog
<amazon-web-services><amazon-ec2><load-balance><api><aws-elb>
AWS API Gateway as an http proxy to ALB
Most Wanted
# AWS API Gateway as an http proxy to ALB

(Asked by: username_0 on 2020-02-26)

I have a setup of API Gateway proxying all the requests to my EC2 instances behind load balancer (ALB). But I want api endpoint to have a nice domain `my-api.mydomain.com`. I'm trying to accomplish that via [custom domains](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html).

[![first step](https://i.sstatic.net/WloFq.png)](https://i.sstatic.net/WloFq.png)

Then I register `Target Domain Name` generated in Route53 like this

[![second step](https://i.sstatic.net/KM8Bt.png)](https://i.sstatic.net/KM8Bt.png)

and my http proxy setup is just a passthrough to the ALB which manages requests to underlying EC2 instances providing business logic.

[![third step](https://i.sstatic.net/34Z1M.png)](https://i.sstatic.net/34Z1M.png)

This setup doesn't work, so I'm wondering what's wrong with this configuration and what critical conceptual thing I have missed. Doing `curl -SL https://my-api.mydomain.com/v1/records/` (or any api endpoint) throws `{"message": "Internal server error"}`. CloudWatch logs shows

> Execution failed due to configuration error: Host name
> 'my-api-lb-111222333.us-east-1.elb.amazonaws.com' does not match the
> certificate subject provided by the peer (CN=\*.mydomain.com)

I'd be grateful for any suggestions.

**Tags:** amazon-web-services, amazon-ec2, load-balance, api, aws-elb

> **Comments:**
> **username_1**: Can Cloud front go in front of api gateway  
> **username_2**: @username_1 yes, it can, but that wouldn't address the issue here, which is behind API Gateway.   Wait... maybe you are one step ahead of me? CloudFront could be used *instead* of API Gateway for this setup, and it would not require a separate hostname on the backend if the HTTP `host` header is whitelisted for forwarding in the CloudFront Cache Behavior settings and the cert on the ALB matches the domain name pointed to the front side of CloudFront.  That would also be cheaper if there's no need for API Gateway advanced capabilities *("http proxy setup is just a passthrough")*.  Hmmm.  
> **username_1**: @Michael-sqlbot I only thought intuiatively the cert could sit on Cloudfront instead. Other thought I just had was a Network Load Balancer instead of ALB, but depends what exactly the ALB does  

---

## 1 answers

### Answer by username_2 on 2020-02-26. Score: 2 | Accepted answer

Try directly accessing `https://my-api-lb-111222333.us-east-1.elb.amazonaws.com` from your web browser and you'll get a similar error. The SSL certificate is not just used for encryption -- it also verifies that the host is not an impostor, by being consulted in a check of whether the hostname used to access the target matches the hostname of the certificate that's offered by the target

Because amazonaws.com is not your domain, you can't get a certificate for that.

You need to assign a domain name from your domain to the ALB in DNS, e.g. `origin.example.com`, and point API Gateway to that name, not to the system-assigned hostname of the ALB.

> **Comments:**
> **username_0**: yes, that worked, the only issue is that I have to create 2 DNS records in route53 - one for my custom api domain and the other one that is just an alias for alb. Thanks anyway  

---

