How to setup the SSL comunication between API Gateway and microservices?

Question

I'm setting up an environment with an API Gateway (KONG) and microservices (Spring-boot apps), but I have a lot of doubts/concerns with the SSL communication between them.

Should I put the SSL settings in the API Gateway or on the microservices?

Currently my microservice app has its own SSL certificate and it runs in a container through 8443 port.

But now implementing the API Gateway, I'm not sure if I have to remove it from my microservice and setting up in the API Gateway or add it in both.

I expect the correct communication between my microservice and the API Gateway in order to the clients are able to consume the services through 8443/ssl.

Answer 1

Your API gateway will be facing the clients. So for secure communication, your API gateway must be behind the SSL.

Regarding microservice, it's up to you to have it behind SSL or not. Both way it will work. According to me, if your microservices are restricted within the VPC (and API gateway is part of the same VPC) and not exposed publicly, then there is no need to have microservices as well behind SSL.