2 way SSL - decouple client cert validation from SSL termination

Question

We are in the process of moving a 2-way SSL enabled web service to Amazon Web Service cloud. Since AWS doesn't support 2-way SSL, I was thinking if it is possible to decouple the 2-way SSL process: Terminate the SSL at the Elastic load balancer but validate the client cert in the CXF application using custom code?

I don't prefer to make our clients to change their implementations from the current 2-way SSL setup.

Answer 1

You could do this using TCP load balancing and terminating the SSL connection at your server instead. Somewhat more info here under "Using Back-End Server Authentication with Elastic Load Balancing":

http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html