Scenarios

Enable mutual authentication when the business requires both the server and client to verify legitimacy. After enabling, the server must verify the client's legitimacy in addition to the client verifying the server's legitimacy.

Preparations

Create a VPC and subnet. See Creating a VPC for the operation.

Create one public CLB instance and two Elastic Compute Service instances within the subnet. See Creating a CLB instance and Creating an ECS for the operation.

Deploy Nginx service on the two Elastic Compute Service instances. See Building a backend service for the operation.

Create a backend server group and add two Elastic Compute Service instances. Refer to Creating Server Group and Adding Backend Server.

Purchase a certificate from VolcanoEngine Certificate Center or buy a server certificate from another provider and upload it to VolcanoEngine Certificate Center.

Purchase private certificates from Private CA. For the procedure, see Private CA Getting started.

Procedures

Step one: install client certificate

Linux client

Windows client

Compress the private certificate package upload to the Linux client.

Log in to the Linux client and extract the bundle:

tar -vxf <证书名称> -C <指定目录，如 /root/ca>

Change directory permissions.

sudo chmod 700 /root/ca

Step two: configure HTTPS mutual authentication

Log in to CLB console.

In the top menu bar, select the target project and region.

Click Configure Listener on the right side of the target CLB instance to enter the listener list page.

Click Add Listener, and see the table below to complete the basic configuration of the listener.

Parameter	Explanation	Example
Listener name	Set the name of Listener.	listener-1
CLB protocol	Select the protocol type for CLB instance listener.	HTTPS
Listening port	Refers to the monitored port.	443
Scheduling algorithm	Specify the rules that the listener follows to forward requests.	Weighted Round Robin (WRR)

Established Timeout uses the default value.

Refer to the table below for more advanced listener configuration features.

Parameter	Explanation	Example
Access control	Indicates whether the listener sets a whitelist or blacklist control for access requests.	Do not enable
Session Persistence	Select whether to enable sticky session for the listener when the scheduler is Weighted Round Robin (WRR).	Do not enable
Enable HTTP 2.0	Select whether to turn on the front-end protocol version HTTP 2.0 for CLB.	Disable
Bandwidth cap	Select whether to enable bandwidth limit for the listener.	Do not enable

Click Next to configure the SSL certificate.

Parameter	Explanation	Example
Certificate source	Select the certificate source, supporting VolcanoEngine Certificate Center.	VolcanoEngine Certificate Center
Select server certificate	Select a server certificate from the dropdown.	xx-certificate-xx
TLS Security Policy	Select whether to enable the TLS (Transport Layer Security, TLS) security policy.	Yes
Select policy	Select the TLS security policy.	tls_cipher_policy_1_2
Mutual authentication	Select whether to enable mutual authentication. Mutual authentication requires not only the client to verify the server's legitimacy, but also the server to verify the client's legitimacy. If enabled, select the CA certificate from the CA certificate parameter dropdown.	Enable, ca-xx

On the Default Server Group configuration page, select the pre-created backend server group and then click Next step.

On the Health Check configuration page, retain default values of all parameters and click Next.

On the Configuration Review page, confirm all settings are correct, then click Confirm to complete the actions.

Verification

Linux client

Windows client

Run the following command:

sudo curl https://<服务器证书绑定的域名>:<端口> --resolve <服务器证书绑定的域名>:<CLB绑定的公网IP> -v --cacert <证书所在目录>certificate_chain.pem --key <证书所在目录>private_key.key --cert <证书所在目录>certificate.pem

Example:

sudo curl https://test.com:443 --resolve test.com:12.XX.XX.182 -v --cacert /root/ca/certificate_chain.pem --key /root/ca/private_key.key --cert /root/ca/certificate.pem

Returning data from the server deployment service indicates successful actions.

Load Balancer