Amazon API Gateway Enables Mutual TLS Authentication for Backend Integrations

API Gateway now supports presenting user-managed ACM certificates to backend services during TLS handshakes, enhancing end-to-end mutual TLS security.

By Lydia Stone · Editorial pseudonym · 2026-09-08 · 1 min read

AI-ASSISTED REPORTING · RETROSPECTIVE ARCHIVE

Retrospective edition: 2026-09-08. Source published: 2026-09-08. Added to this archive: 2026-11-03. This briefing was prepared later from the linked announcement; it was not published on this website on the historical edition date.

Previously restricted to self-signed API Gateway certificates, this update allows using certificates issued by trusted certificate authorities, enabling tighter identity verification between API Gateway and backend endpoints. This facilitates compliance with security standards prevalent in sectors like finance and healthcare, where mutual authentication is mandatory across both client-to-API and API-to-backend communication.

The service supports certificate importation from existing PKI or issuance via AWS Private CA, and automatically propagates certificate renewals without downtime. The feature is available across all commercial and GovCloud AWS regions where API Gateway REST APIs operate, configurable through CLI, console, or CloudFormation.

Source & further reading

Amazon API Gateway now supports mutual TLS for backend integrations ↗

Source published 2026-09-08. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.