Amazon CloudFront Adds Mutual TLS Passthrough Mode for Origin Certificate Verification
Amazon CloudFront now supports a mutual TLS passthrough mode that allows viewer certificates to be forwarded directly to origin servers for verification. This update enables organizations to maintain existing mTLS infrastructure without offloading certificate validation to CloudFront trust stores.
Amazon CloudFront has expanded its viewer mutual TLS authentication capabilities with a new passthrough mode. Previously, users had to choose between mandatory or optional modes, both of which required CloudFront to perform certificate validation using a trust store. With the passthrough option, CloudFront simply forwards the client certificate to the origin server, allowing the backend to handle the full authentication process.
Primary source
Open AWS What's New ↗This article summarizes the source. Check the original for full details and conditions.
Comparison
| Aspect | Before / Alternative | After / This |
|---|---|---|
| Validation Location | CloudFront edge location using trust stores | Backend origin server infrastructure |
| Configuration | Requires managing trust stores within AWS | No trust store configuration needed in CloudFront |
| Operational Flow | Offloads mTLS processing to the CDN | Maintains existing mTLS logic on the origin |
| Viewer Certificate | Terminated and validated at the edge | Forwarded directly to the backend for review |
Action Checklist
- Identify existing origin servers with mTLS validation logic Useful for backends that already manage their own certificate authorities
- Update CloudFront cache policy to forward the necessary headers Ensure the origin can receive and parse the client certificate
- Enable mTLS passthrough in the CloudFront distribution settings This feature is available at no additional cost
- Test origin connectivity to ensure proper certificate handling Verify that the backend correctly rejects invalid viewer certificates