Mechanism for enforcing access control at scale to an internet service using transport layer security (TLS)

1 . A system, comprising:

a plurality of scalable load balancers configured to enable client certificate access control using mutual transport layer security (mTLS) authentication; and

a trust store manager service comprising computer hardware and configured to:

receive trust store files including a certificate authority (CA) bundle and a certificate revocation list (CRL);

generate a single trust store file based on the trust store files, wherein the single trust store file comprises a first database storing the CA bundle and a second database storing the CRL such that determining that the CRL includes a given certificate does not require checking the first database; and

distribute a snapshot of the single trust store file to the plurality of scalable load balancers,

wherein the plurality of scalable load balancers are further configured to:

verify, using the snapshot of the single trust store file, a client certificate from a client device by searching for a trusted CA from the CA bundle in the snapshot of the single trust store file;

determine whether the CRL contained in the snapshot of the single trust store file includes the client certificate; and

upon verifying the client certificate and determining that the CRL does not contain the client certificate, transmit connection data from the client device to an application target.

2 . The system of claim 1 , wherein the single trust store file is a lightning memory-mapped database (LMDB) file generated in a pre-indexed format to allow rapid searching, without accessing multiple ones of the trust store files and without loading the single trust store file into memory.

3 . The system of claim 2 , wherein the scalable load balancer is further configured to:

submit a load balancer certificate to a client for authentication in an mTLS handshake;

receive a client certificate for authentication in an mTLS handshake;

determine that the client certificate is authenticated based at least in part on a signature on the client certificate; and

upon determining the client certificate is authenticated, exchange cryptographic keys with the client to allow encrypted communication with the client.

4 . The system of claim 1 , wherein the plurality of scalable load balancers are further configured to revoke access of an invalid client certificate based on the invalid client certificate being included in the CRL of the single trust store file.

5 . A computer-implemented method comprising:

providing a plurality of scalable load balancers;

receiving, from a client device, a request to connect to an application target, the request including a client certificate for verification by a scalable load balancer of the plurality of scalable load balancers, wherein the scalable load balancer has access to a snapshot of a trust store storing a single memory mappable database management file comprising information usable to verify client certificates;

determining a signing certificate authority (CA) for the client certificate, wherein the signing CA is a CA that produced a signature on the client certificate;

determining a trust store CA for the client certificate, wherein the trust store CA is recorded in the snapshot of the trust store storing the single memory mappable database management file for use by the scalable load balancer during verification;

verifying the client certificate based at least in part on a comparison between the signing CA and the trust store CA; and

upon verifying the client certificate, transmitting connection data received from the client device to an application target.

6 . The computer-implemented method of claim 5 , wherein verifying the client certificate further comprises:

determining the client certificate is contained in a certificate revocation list (CRL) of a trust store; and

revoking access of the client certificate based on determining that the client certificate is contained in the CRL.

7 . The computer-implemented method of claim 5 , wherein verifying the client certificate further comprises:

determining the client certificate is not contained in a certificate revocation list (CRL) of a trust store; and

allowing access to the client certificate based at least in part on determining that the client certificate is not contained in the CRL.

8 . The computer-implemented method of claim 5 , wherein the single memory mappable database management file is a lightning memory database (LMDB) file using a pre-indexed format to allow rapid searching, without requiring the single memory mappable database management file to be loaded into memory, and without accessing multiple files.

9 . The computer-implemented method of claim 5 , further comprising:

submitting, using the scalable load balancer, a load balancer certificate to a client for authentication in an mTLS handshake;

receiving a client certificate for authentication in the scalable load balancer in an mTLS handshake;

determining that the client certificate is authenticated based at least in part on a signature on the client certificate; and

upon determining the client certificate is authenticated, exchange cryptographic keys with the client to allow encrypted communication with the client.

10 . The computer-implemented method of claim 5 , further comprising generating a connection log, wherein the connection log allows a user to inspect a verification result of each TLS connection, and wherein the connection log identifies a TLS protocol, TLS cipher, TLS handshake latency, a client's leaf certificate information, and whether verification was successful or not.

11 . The computer-implemented method of claim 5 , further comprising implementing a pass through mode for access control, wherein the scalable load balancer passes an incoming client certificate to one or more load balancer targets for validation without validating the incoming client certificate at the scalable load balancer.

12 . The computer-implemented method of claim 5 , further comprising implementing a verify mode for access control, wherein the scalable load balancer authenticates an incoming client certificate at the scalable load balancer using a mutual transport layer security (mTLS) handshake.

13 . A non-transitory computer readable medium storing instructions that, when executed by a computing system within a cloud provider network, cause the computing system to perform operations including:

providing a plurality of scalable load balancers;

receiving a client certificate for verification by a scalable load balancer of the plurality of scalable load balancers, wherein the scalable load balancer comprises a trust store to store a single memory mappable database management file, and wherein a snapshot of the trust store is distributed across the plurality of scalable load balancers and any number of a plurality of customer accounts;

determining a signing certificate authority (CA) for the client certificate, wherein the signing CA is a CA that produced a signature on the client certificate;

determining a trust store CA for the client certificate, wherein the trust store CA is recorded in the snapshot of the trust store storing the single memory mappable database management file for use by the scalable load balancer during verification;

verifying the client certificate based at least in part on a comparison between the signing CA and the trust store CA.

14 . The non-transitory computer readable medium of claim 13 , wherein verifying the client certificate further comprises:

determining the client certificate is contained in a certificate revocation list (CRL) of the trust store; and

revoking access of the client certificate based on determining that the client certificate is contained in the CRL.

15 . The non-transitory computer readable medium of claim 13 , wherein verifying the client certificate further comprises:

determining the client certificate is not contained in a certificate revocation list (CRL) of the trust store; and

allowing access to the client certificate based at least in part on determining that the client certificate is not contained in the CRL.

16 . The non-transitory computer readable medium of claim 13 , wherein the single memory mappable database management file is a lightning memory database (LMDB) file using a pre-indexed format to allow rapid searching, without requiring the single memory mappable database management file to be loaded into memory, and without accessing multiple files.

17 . The non-transitory computer readable medium of claim 13 , further comprising:

submitting, using the scalable load balancer, a load balancer certificate to a client for authentication in an mTLS handshake;

receiving a client certificate for authentication in the scalable load balancer in an mTLS handshake;

determining that the client certificate is authenticated based at least in part on a signature on the client certificate; and

upon determining the client certificate is authenticated, exchange cryptographic keys with the client to allow encrypted communication with the client.

18 . The non-transitory computer readable medium of claim 13 , further comprising generating a connection log, wherein the connection log allows a user to inspect a verification result of each TLS connection, and wherein the connection log identifies a TLS protocol, TLS cipher, TLS handshake latency, a client's leaf certificate information, and whether verification was successful or not.

19 . The non-transitory computer readable medium of claim 13 , further comprising implementing a pass through mode for access control, wherein the scalable load balancer passes an incoming client certificate chain to one or more load balancer targets for validation without validating the incoming client certificate chain at the scalable load balancer.

20 . The non-transitory computer readable medium of claim 13 , further comprising implementing a verify mode for access control, wherein the scalable load balancer authenticates an incoming client certificate chain at the scalable load balancer using a mutual transport layer security (mTLS) handshake.