API Gateway REST API stages should be configured to use SSL certificates for backend authentication

How to fix it

• Can break clients: Some backend servers do not support API Gateway's SSL client authentication and answer with a certificate error, so test the integration before switching production.

In the console

API Gateway → APIs → the REST API → Stages → the stage → Stage details

Client certificates

A certificate made with Generate certificate, or an imported or private ACM certificate

Client certificate

That certificate; a generated one is valid for 365 days, so rotate it before it expires

With the AWS CLI

aws apigateway update-stage --rest-api-id <rest-api-id> --stage-name <stage-name> --patch-operations op=replace,path=/clientCertificateId,value=<client-certificate-id>

With Terraform

resource "aws_api_gateway_stage" "this" {
  rest_api_id           = var.rest_api_id
  stage_name            = var.stage_name
  deployment_id         = var.deployment_id
  client_certificate_id = aws_api_gateway_client_certificate.this.id
}