Enable SSL Encryption from LB to Kong Instances

[lorenzoaiello]

We need end-to-end encryption, including SSL from the ALB to the EC2 instances.

[DennoVonDiesel]

Would it be sufficient to optionally provision an NLB or Classic ELB for passthrough SSL directly to Kong?

[lorenzoaiello]

Definitely an option, we'd just need to figure out how we want to get the SSL certs on the Kong instances (assuming they can't be applied via the API once it's online - I've not looked into the possibility of doing that).

[p0pr0ck5]

Kong has a notion of a per-service certificates, so it would be wrong to assume there would be just one certificate for an ALB to establish a handshake with.

It makes sense for an NLB to front Kong, given that Kong supports more than just HTTP traffic. And the NLB can still perform HTTP healthcheck to the upstream ASG.