[アップデート] Amazon CloudFrontがmTLSをサポートしたのでクライアント証明書の検証をしてみた

{
  "connectionId": "Fdb-Eb7L9gVn2cFakz7wWyBJIDAD4-oNO6g8r3vXDV132BtnIVtqDA==", // Unique identifier for this TLS connection
  "clientIp": "203.0.113.42", // IP address of the connecting client (IPv4 or IPv6)
  "clientCertificate": {
    "certificates": {
      "leaf": {
        "subject": "CN=client.example.com,O=Example Corp,C=US", // Distinguished Name (DN) of the certificate holder
        "issuer": "CN=Example Corp Intermediate CA,O=Example Corp,C=US", // Distinguished Name (DN) of the certificate authority that issued this certificate
        "serialNumber": "4a:3f:5c:92:d1:e8:7b:6c", // Unique serial number assigned by the issuing CA (hexadecimal)
        "validity": {
 "notBefore": "2024-01-15T00:00:00Z", // Certificate validity start date (ISO 8601 format)
 "notAfter": "2025-01-14T23:59:59Z"   // Certificate expiration date (ISO 8601 format)
        },
        "sha256Fingerprint": "a1b2c3d4e5f6...abc123def456", // SHA-256 hash of the certificate (64 hex characters)
      },
    },
  },
}

$ openssl req \
    -x509 \
    -new \
    -days 7 \
    -keyout rootCA_key.pem \
    -out rootCA_cert.pem
..+++++++++++++++++++++++++++++++++++++++*..
.
.
(中略)
.
.
.....++++++
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:root-ca
Email Address []:

$ cat rootCA_cert.pem
-----BEGIN CERTIFICATE-----
MIIDqTCCApGgAwIBAgIUdEGHxctVOm29JJnc35PRA4jT4tEwDQYJKoZIhvcNAQEL
BQAwZDELMAkGA1UEBhMCSlAxDjAMBgNVBAgMBVRva3lvMRUwEwYDVQQHDAxEZWZh
dWx0IENpdHkxHDAaBgNVBAoME0RlZmF1bHQgQ29tcGFueSBMdGQxEDAOBgNVBAMM
B3Jvb3QtY2EwHhcNMjUxMTI3MTAxNjIxWhcNMjUxMjA0MTAxNjIxWjBkMQswCQYD
VQQGEwJKUDEOMAwGA1UECAwFVG9reW8xFTATBgNVBAcMDERlZmF1bHQgQ2l0eTEc
MBoGA1UECgwTRGVmYXVsdCBDb21wYW55IEx0ZDEQMA4GA1UEAwwHcm9vdC1jYTCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIbee0pd1JakvdeCxoTQrz1C
qes4f4Sva5s75V19+aWqHMICljpplQUZUrSbWBNzG4WL8PTZe1elQIrC0invDQE+
cq1Ol/iv8QSOeKgiTiYFLBpsKxQuZ6hnfl4jwimEoytdJlBdmJ1CIXLjAJBQmrgj
NkBMH3KE6EyiY/u/vBOEvF3zA8lPq2/KSq8SiW9u+WYRHgxS6WNNAkeHXyMPBPi+
5AcBIaT5ZpN4Ay5pQ0B010YTWo1ZLWuwg9YEcFLvDTe5wll0LxGOvUNICKYKtsX2
/PJOU0WvUPspHI0+Poek6SCWfAodt+iZVXvh5WRIsh8NMqNeGLul7jHHeUNdR8UC
AwEAAaNTMFEwHQYDVR0OBBYEFNx8y9Y/6GGFz09UrJcQFZVnGfydMB8GA1UdIwQY
MBaAFNx8y9Y/6GGFz09UrJcQFZVnGfydMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
hvcNAQELBQADggEBABzPLW3lttnvHHj9YfMDvSEE0RLqyRSCp163vD3JvxewigSE
RmsO7NTPt0rKgHg21jFGSX0Bv/h7MePzrbWiJD/QSwJIYnzx+IYGZLnl8sd76syu
c0yRD8ABmVo+n7W+kTYzAZhCFDviLPG+04CergDtDBAG8efzKpKxpfbBTOC23h64
k7qcaizjQHWM0bL7MNDG13YaOAnMdcMRNp4cj468FzCYHAzCBC5QVjk0A1U4p9qJ
SSYOqLwyHzYfUebiuJp1+d/pGFWZRswovQUcqZYIgNnEWCVdIQsUDJgIKbnxdpip
P+dwjlFcaEUqPEtai9ptNIUtb8be1W42Z1DB0aA=
-----END CERTIFICATE-----

$ openssl req \
    -x509 \
    -CA rootCA_cert.pem \
    -CAkey rootCA_key.pem \
    -days 7 \
    -new \
    -nodes \
    -keyout client_key_test1.pem \
    -out client_cert_test1.pem
...+...+..............
.
.
(中略)
.
.
...+..++++++
-----
Enter pass phrase for rootCA_key.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:Test 1 BU
Common Name (eg, your name or your server's hostname) []:Test 1
Email Address []:

$ openssl x509 -text -noout -in client_cert_test1.pem
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
   01:e5:f0:60:df:9a:92:dd:40:c7:31:61:2e:72:7b:ae:0e:20:00:b9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=JP, ST=Tokyo, L=Default City, O=Default Company Ltd, CN=root-ca
        Validity
   Not Before: Nov 27 10:18:17 2025 GMT
   Not After : Dec  4 10:18:17 2025 GMT
        Subject: C=JP, ST=Tokyo, L=Default City, O=Default Company Ltd, OU=Test 1 BU, CN=Test 1
        Subject Public Key Info:
   Public Key Algorithm: rsaEncryption
       Public-Key: (2048 bit)
       Modulus:
  00:ea:ff:73:9a:2d:b1:94:44:2e:a2:7d:ef:29:28:
  78:19:3a:06:c8:5c:7e:7b:ef:74:67:96:e7:64:05:
  d9:d7:b5:43:10:a4:de:c0:99:1e:57:1f:6b:3e:18:
  08:a9:ac:f9:8d:29:fe:f8:74:82:c1:67:f3:48:51:
  08:56:4a:6f:00:c1:f4:80:68:41:fa:89:38:33:6a:
  5b:c8:a1:67:d0:8a:32:e1:29:e1:ce:8a:31:62:f0:
  57:57:9f:de:29:4a:ba:ea:b8:63:cf:b2:60:5e:b9:
  be:78:a6:e3:6a:da:7b:dc:98:d2:58:1b:e8:85:42:
  a5:56:bc:bf:33:eb:7e:73:0e:82:51:f8:2f:c3:57:
  e7:27:b6:f2:60:73:18:70:cb:52:7c:b1:b6:08:6f:
  f8:34:3e:7c:37:44:af:2b:9d:b0:ec:44:f5:0b:4a:
  09:96:f9:ba:f3:92:92:e7:a3:ba:65:cf:77:12:66:
  4b:1e:68:07:35:91:85:74:9e:ac:be:8a:92:02:b0:
  df:fb:71:9b:0d:a2:3b:b5:d8:15:bf:e5:92:15:27:
  c5:f2:9d:a9:f6:dd:78:9d:60:4a:74:0b:2f:12:6d:
  3e:f1:c4:59:01:73:29:54:b7:8b:f8:e1:69:f1:72:
  95:47:58:36:c0:57:5f:9a:49:c2:db:e6:73:25:0d:
  78:07
       Exponent: 65537 (0x10001)
        X509v3 extensions:
   X509v3 Subject Key Identifier:
       34:45:36:CE:E4:1B:A6:1F:5F:EE:81:A2:C0:70:CA:58:7A:E4:B0:4A
   X509v3 Authority Key Identifier:
       DC:7C:CB:D6:3F:E8:61:85:CF:4F:54:AC:97:10:15:95:67:19:FC:9D
   X509v3 Basic Constraints: critical
       CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        7f:b5:f5:a7:3c:4b:7f:dc:b5:f2:4c:cf:61:87:3c:4a:14:0a:
        35:eb:fd:ba:e7:22:f6:74:46:ef:b3:3d:a9:28:93:36:9d:f9:
        3f:a5:9f:d0:74:e2:32:ba:16:67:d4:89:23:29:52:66:c9:da:
        42:e9:ad:35:b0:58:96:d8:b7:50:8a:15:4f:a4:62:65:e3:e5:
        7e:d8:0c:71:0e:a6:44:15:01:bc:69:68:bd:19:27:2f:d5:9e:
        ed:1d:9e:f2:6e:51:1d:b4:04:6a:bf:66:c0:46:69:6f:af:77:
        14:f5:80:f5:94:77:16:5a:12:be:dc:2a:ee:90:8d:ad:77:5c:
        b7:5b:65:19:53:2d:f9:00:ba:4b:bb:df:05:73:29:09:d0:26:
        3d:3c:be:53:b1:b2:82:82:49:f8:7c:e8:6e:ca:f7:00:87:fc:
        a1:3d:ae:de:31:aa:38:00:b6:9d:6e:91:e7:73:48:55:b8:ad:
        70:25:81:86:9a:09:bb:fc:1a:e8:e1:c1:52:76:6d:fb:19:8b:
        a9:47:d4:82:ba:47:6a:44:b9:22:dd:38:bc:97:a6:93:74:11:
        76:4b:6c:e9:90:4e:11:a0:cf:44:cd:7a:ce:ee:3f:43:59:0c:
        ef:5f:bb:86:e9:4b:4c:9c:1b:48:2e:67:79:95:58:c1:b8:d9:
        ee:2d:40:9b

$ curl https://www.non-97.net -v
* Host www.non-97.net:443 was resolved.
* IPv6: (none)
* IPv4: 108.138.85.24, 108.138.85.20, 108.138.85.82, 108.138.85.44
*   Trying 108.138.85.24:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
*  CApath: none
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / x25519 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=www.non-97.net
*  start date: Feb 24 00:00:00 2025 GMT
*  expire date: Mar 25 23:59:59 2026 GMT
*  subjectAltName: host "www.non-97.net" matched cert's "www.non-97.net"
*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M03
*  SSL certificate verify ok.
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Connected to www.non-97.net (108.138.85.24) port 443
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://www.non-97.net/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: www.non-97.net]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.11.1]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: www.non-97.net
> User-Agent: curl/8.11.1
> Accept: */*
>
* Request completely sent off
* TLSv1.3 (IN), TLS alert, close notify (256):
* closing connection #0
curl: (16) Error in the HTTP2 framing layer

$ curl https://www.non-97.net \
    --key client_key_test1.pem \
    --cert client_cert_test1.pem \
    -v
* Host www.non-97.net:443 was resolved.
* IPv6: (none)
* IPv4: 108.138.85.44, 108.138.85.24, 108.138.85.82, 108.138.85.20
*   Trying 108.138.85.44:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
*  CApath: none
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS handshake, CERT verify (15):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / x25519 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=www.non-97.net
*  start date: Feb 24 00:00:00 2025 GMT
*  expire date: Mar 25 23:59:59 2026 GMT
*  subjectAltName: host "www.non-97.net" matched cert's "www.non-97.net"
*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M03
*  SSL certificate verify ok.
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Connected to www.non-97.net (108.138.85.44) port 443
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://www.non-97.net/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: www.non-97.net]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.11.1]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: www.non-97.net
> User-Agent: curl/8.11.1
> Accept: */*
>
* Request completely sent off
< HTTP/2 200
< content-type: text/html
< content-length: 12
< date: Thu, 27 Nov 2025 10:53:15 GMT
< last-modified: Tue, 25 Feb 2025 02:38:39 GMT
< etag: "56aec8b7843df637b3fb2ec0b027e5b6"
< x-amz-server-side-encryption: AES256
< accept-ranges: bytes
< server: AmazonS3
< x-cache: Miss from cloudfront
< via: 1.1 c6bba20dc3ec8526b729f039a2fdf7ae.cloudfront.net (CloudFront)
< x-amz-cf-pop: IAD12-P2
< x-amz-cf-id: QrU7g3CmAEB-yv3lzqK3hHjV8bWZq61lFrqd-GLB9Kfktc1BTz92Ww==
< x-xss-protection: 1; mode=block
< x-frame-options: SAMEORIGIN
< referrer-policy: strict-origin-when-cross-origin
< x-content-type-options: nosniff
< strict-transport-security: max-age=31536000
<
/index.html
* Connection #0 to host www.non-97.net left intact

{
  "eventTimestamp": 1764240547413,
  "connectionId": "jcjbyIT6plZdRHKVAUunc0OAntEtmgNhiXbI2nuWOvu9n4J5my4jhA==",
  "distributionId": "ELGQOVCCUO3ME",
  "connectionStatus": "Failed:ClientCertMissing",
  "clientIp": "18.207.134.47",
  "clientPort": "37092",
  "serverIp": "108.138.85.24",
  "distributionTenantId": "-",
  "tlsProtocol": "TLSv1.3",
  "tlsCipher": "TLS_AES_128_GCM_SHA256",
  "tlsHandshakeDuration": 15,
  "tlsSni": "www.non-97.net",
  "clientLeafCertSerialNumber": "-",
  "clientLeafCertSubject": "-",
  "clientLeafCertIssuer": "-",
  "clientLeafCertValidity": "-",
  "connectionLogCustomData": "-"
}

{
  "eventTimestamp": 1764240588632,
  "connectionId": "oztvKdh3ftSYifMJHkcbnX6jFgKfFlKE6BT7PDc-KcuQ8PBUNt5_LA==",
  "distributionId": "ELGQOVCCUO3ME",
  "connectionStatus": "Failed:UnmappedConnectionError",
  "clientIp": "104.28.236.107",
  "clientPort": "40170",
  "serverIp": "3.173.254.16",
  "distributionTenantId": "-",
  "tlsProtocol": "TLSv1.3",
  "tlsCipher": "TLS_AES_128_GCM_SHA256",
  "tlsHandshakeDuration": 821,
  "tlsSni": "www.non-97.net",
  "clientLeafCertSerialNumber": "-",
  "clientLeafCertSubject": "-",
  "clientLeafCertIssuer": "-",
  "clientLeafCertValidity": "-",
  "connectionLogCustomData": "-"
}

{
  "eventTimestamp": 1764240794284,
  "connectionId": "e8Cx1UpCdn9lp2ZaUxQaUQ47O_oo7C1ezy5JBcG-wLCP_Wlt7IU-1w==",
  "distributionId": "ELGQOVCCUO3ME",
  "connectionStatus": "Success",
  "clientIp": "18.207.134.47",
  "clientPort": "47384",
  "serverIp": "108.138.85.44",
  "distributionTenantId": "-",
  "tlsProtocol": "TLSv1.3",
  "tlsCipher": "TLS_AES_128_GCM_SHA256",
  "tlsHandshakeDuration": 11,
  "tlsSni": "www.non-97.net",
  "clientLeafCertSerialNumber": "01:e5:f0:60:df:9a:92:dd:40:c7:31:61:2e:72:7b:ae:0e:20:00:b9",
  "clientLeafCertSubject": "C=JP,%20ST=Tokyo,%20L=Default%20City,%20O=Default%20Company%20Ltd,%20OU=Test%201%20BU,%20CN=Test%201",
  "clientLeafCertIssuer": "C=JP,%20ST=Tokyo,%20L=Default%20City,%20O=Default%20Company%20Ltd,%20CN=root-ca",
  "clientLeafCertValidity": "NotBefore=2025-11-27T10:18:17Z;NotAfter=2025-12-04T10:18:17Z",
  "connectionLogCustomData": "-"
}

$ curl https://www.non-97.net -v
* Host www.non-97.net:443 was resolved.
* IPv6: (none)
* IPv4: 108.138.85.20, 108.138.85.24, 108.138.85.82, 108.138.85.44
*   Trying 108.138.85.20:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
*  CApath: none
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / x25519 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=www.non-97.net
*  start date: Feb 24 00:00:00 2025 GMT
*  expire date: Mar 25 23:59:59 2026 GMT
*  subjectAltName: host "www.non-97.net" matched cert's "www.non-97.net"
*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M03
*  SSL certificate verify ok.
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Connected to www.non-97.net (108.138.85.20) port 443
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://www.non-97.net/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: www.non-97.net]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.11.1]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: www.non-97.net
> User-Agent: curl/8.11.1
> Accept: */*
>
* Request completely sent off
* TLSv1.3 (IN), TLS alert, close notify (256):
* closing connection #0
curl: (16) Error in the HTTP2 framing layer

$ curl https://www.non-97.net -vvv
04:19:21.727292 [0-x] == Info: [READ] client_reset, clear readers
04:19:21.743075 [0-0] == Info: Host www.non-97.net:443 was resolved.
04:19:21.743401 [0-0] == Info: IPv6: (none)
04:19:21.743478 [0-0] == Info: IPv4: 108.138.85.44, 108.138.85.82, 108.138.85.24, 108.138.85.20
04:19:21.743728 [0-0] == Info: [HTTPS-CONNECT] added
04:19:21.743872 [0-0] == Info: [HTTPS-CONNECT] connect, init
04:19:21.744063 [0-0] == Info: [HTTPS-CONNECT] connect, check h21
04:19:21.744530 [0-0] == Info:   Trying 108.138.85.44:443...
04:19:21.744746 [0-0] == Info: [HTTPS-CONNECT] connect -> 0, done=0
04:19:21.744936 [0-0] == Info: [HTTPS-CONNECT] adjust_pollset -> 1 socks
04:19:21.745285 [0-0] == Info: [HTTPS-CONNECT] connect, check h21
04:19:21.745480 [0-0] == Info: [SSL] cf_connect()
04:19:21.747474 [0-0] == Info: [SSL] No cached session ID for https://www.non-97.net:443
04:19:21.747742 [0-0] == Info: ALPN: curl offers h2,http/1.1
04:19:21.748162 [0-0] => Send SSL data, 5 bytes (0x5)
0000: .....
04:19:21.748386 [0-0] == Info: TLSv1.3 (OUT), TLS handshake, Client hello (1):
04:19:21.748579 [0-0] => Send SSL data, 512 bytes (0x200)
0000: ............3......-^.....#.....>..... wvH.......~.w......^..PvF
.
.
(中略)
.
.
01c0: ................................................................
04:19:21.750354 [0-0] == Info: [SSL] ossl_bio_cf_out_write(len=517) -> 517, err=0
04:19:21.750573 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=5) -> -1, err=81
04:19:21.750782 [0-0] == Info: [SSL] populate_x509_store, path=/etc/pki/tls/certs/ca-bundle.crt, blob=0
04:19:21.759457 [0-0] == Info:  CAfile: /etc/pki/tls/certs/ca-bundle.crt
04:19:21.759582 [0-0] == Info:  CApath: none
04:19:21.759700 [0-0] == Info: [SSL] SSL_connect() -> err=-1, detail=2
04:19:21.759889 [0-0] == Info: [SSL] SSL_connect() -> want recv
04:19:21.760023 [0-0] == Info: [SSL] cf_connect() -> 0, done=0
04:19:21.760126 [0-0] == Info: [HTTPS-CONNECT] connect -> 0, done=0
04:19:21.760257 [0-0] == Info: [SSL] adjust_pollset, POLLIN fd=4
04:19:21.760413 [0-0] == Info: [HTTPS-CONNECT] adjust_pollset -> 1 socks
04:19:21.760589 [0-0] == Info: [HTTPS-CONNECT] connect, check h21
04:19:21.760765 [0-0] == Info: [SSL] cf_connect()
04:19:21.760904 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=5) -> 5, err=0
04:19:21.761095 [0-0] <= Recv SSL data, 5 bytes (0x5)
0000: ....z
04:19:21.761315 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=122) -> 122, err=0
04:19:21.761553 [0-0] == Info: TLSv1.3 (IN), TLS handshake, Server hello (2):
04:19:21.761775 [0-0] <= Recv SSL data, 122 bytes (0x7a)
0000: ...v...#..}Y@!.J[...L-:...jU %.J...... wvH.......~.w......^..PvF
0040: ....WD.......+.....3.$... Y..*g......\.....5.+..FVD.....c.
04:19:21.762589 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=5) -> 5, err=0
04:19:21.762795 [0-0] <= Recv SSL data, 5 bytes (0x5)
0000: .....
04:19:21.762962 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=1) -> 1, err=0
04:19:21.763171 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=5) -> 5, err=0
04:19:21.763382 [0-0] <= Recv SSL data, 5 bytes (0x5)
0000: ....$
04:19:21.763556 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=36) -> 36, err=0
04:19:21.763789 [0-0] <= Recv SSL data, 1 bytes (0x1)
0000: .
04:19:21.763971 [0-0] == Info: TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
04:19:21.764129 [0-0] <= Recv SSL data, 19 bytes (0x13)
0000: .................h2
04:19:21.764310 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=5) -> 5, err=0
04:19:21.764511 [0-0] <= Recv SSL data, 5 bytes (0x5)
0000: .....
04:19:21.764680 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=164) -> 164, err=0
04:19:21.764907 [0-0] <= Recv SSL data, 1 bytes (0x1)
0000: .
04:19:21.765077 [0-0] == Info: TLSv1.3 (IN), TLS handshake, Request CERT (13):
04:19:21.765272 [0-0] <= Recv SSL data, 147 bytes (0x93)
0000: ....................................../.j.h.f0d1.0...U....JP1.0.
0040: ..U....Tokyo1.0...U....Default City1.0...U....Default Company Lt
0080: d1.0...U....root-ca
04:19:21.765962 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=5) -> 5, err=0
04:19:21.766148 [0-0] <= Recv SSL data, 5 bytes (0x5)
0000: .....
04:19:21.766341 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=3820) -> 3820, err=0
04:19:21.766570 [0-0] <= Recv SSL data, 1 bytes (0x1)
0000: .
04:19:21.766662 [0-0] == Info: TLSv1.3 (IN), TLS handshake, Certificate (11):
04:19:21.766863 [0-0] <= Recv SSL data, 3803 bytes (0xedb)
0000: ...........0...0..............}.r.5.U.....0...*.H........0<1.0..
.
.
(以下略)
.
.

import cf from 'cloudfront';

async function connectionHandler(connection) {
    const kvsHandle = cf.kvs();
    
    // Get client certificate serial number
    const clientSerialNumber = connection.clientCertificate.certificates.leaf.serialNumber;
    
    // Check if the serial number exists in the KeyValueStore
    const isRevoked = await kvsHandle.exists(clientSerialNumber);
    
    if (isRevoked) {
        console.log(`Certificate ${clientSerialNumber} is revoked. Denying connection.`);
        connection.logCustomData(`REVOKED:${clientSerialNumber}`);
        connection.deny();
    } else {
        connection.logCustomData(`Valid certificate: ${clientSerialNumber}`);
        console.log(`Certificate ${clientSerialNumber} is valid. Allowing connection.`);
        connection.allow();
    }
    
}

$ curl https://www.non-97.net \
    --key client_key_test1.pem \
    --cert client_cert_test1.pem \
    -v
* Host www.non-97.net:443 was resolved.
* IPv6: (none)
* IPv4: 108.138.85.24, 108.138.85.20, 108.138.85.44, 108.138.85.82
*   Trying 108.138.85.24:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
*  CApath: none
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS handshake, CERT verify (15):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / secp256r1 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=www.non-97.net
*  start date: Feb 24 00:00:00 2025 GMT
*  expire date: Mar 25 23:59:59 2026 GMT
*  subjectAltName: host "www.non-97.net" matched cert's "www.non-97.net"
*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M03
*  SSL certificate verify ok.
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Connected to www.non-97.net (108.138.85.24) port 443
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://www.non-97.net/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: www.non-97.net]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.11.1]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: www.non-97.net
> User-Agent: curl/8.11.1
> Accept: */*
>
* Request completely sent off
* TLSv1.3 (IN), TLS alert, close notify (256):
* closing connection #0
curl: (16) Error in the HTTP2 framing layer

$ openssl req \
    -x509 \
    -CA rootCA_cert.pem \
    -CAkey rootCA_key.pem \
    -days 7 \
    -new \
    -nodes \
    -keyout client_key_test2.pem \
    -out client_cert_test2.pem
.....+..........+
.
.
(中略)
.
.
....+...++++++
-----
Enter pass phrase for rootCA_key.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server\'s hostname) []:Test 2
Email Address []:

$ curl https://www.non-97.net \
    --key client_key_test2.pem \
    --cert client_cert_test2.pem \
    -v
* Host www.non-97.net:443 was resolved.
* IPv6: (none)
* IPv4: 108.138.85.20, 108.138.85.24, 108.138.85.82, 108.138.85.44
*   Trying 108.138.85.20:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
*  CApath: none
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS handshake, CERT verify (15):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / secp256r1 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=www.non-97.net
*  start date: Feb 24 00:00:00 2025 GMT
*  expire date: Mar 25 23:59:59 2026 GMT
*  subjectAltName: host "www.non-97.net" matched cert's "www.non-97.net"
*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M03
*  SSL certificate verify ok.
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Connected to www.non-97.net (108.138.85.20) port 443
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://www.non-97.net/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: www.non-97.net]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.11.1]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: www.non-97.net
> User-Agent: curl/8.11.1
> Accept: */*
>
* Request completely sent off
< HTTP/2 200
< content-type: text/html
< content-length: 12
< date: Fri, 28 Nov 2025 04:45:38 GMT
< last-modified: Tue, 25 Feb 2025 02:38:39 GMT
< etag: "56aec8b7843df637b3fb2ec0b027e5b6"
< x-amz-server-side-encryption: AES256
< accept-ranges: bytes
< server: AmazonS3
< x-cache: Hit from cloudfront
< via: 1.1 4685cae701bd588fa0176a1c8b1e52f4.cloudfront.net (CloudFront)
< x-amz-cf-pop: IAD12-P2
< x-amz-cf-id: 9vsFTFRwsg-vdtNIcxV-BTDtq7wNdjdNz-YgYrqsAQlMOg5lQjf10g==
< age: 19269
< x-xss-protection: 1; mode=block
< x-frame-options: SAMEORIGIN
< referrer-policy: strict-origin-when-cross-origin
< x-content-type-options: nosniff
< strict-transport-security: max-age=31536000
<
/index.html
* Connection #0 to host www.non-97.net left intact

{
  "eventTimestamp": 1764324261055,
  "connectionId": "dHAOAFd3fARRQ3dvj1ldEAkGSZPaDw8GLOud1LB17xYY_Wahx076cg==",
  "distributionId": "ELGQOVCCUO3ME",
  "connectionStatus": "Failed:ConnectionFunctionDenied",
  "clientIp": "44.220.54.32",
  "clientPort": "43670",
  "serverIp": "108.138.85.24",
  "distributionTenantId": "-",
  "tlsProtocol": "TLSv1.3",
  "tlsCipher": "TLS_AES_128_GCM_SHA256",
  "tlsHandshakeDuration": 127,
  "tlsSni": "www.non-97.net",
  "clientLeafCertSerialNumber": "01:e5:f0:60:df:9a:92:dd:40:c7:31:61:2e:72:7b:ae:0e:20:00:b9",
  "clientLeafCertSubject": "C=JP,%20ST=Tokyo,%20L=Default%20City,%20O=Default%20Company%20Ltd,%20OU=Test%201%20BU,%20CN=Test%201",
  "clientLeafCertIssuer": "C=JP,%20ST=Tokyo,%20L=Default%20City,%20O=Default%20Company%20Ltd,%20CN=root-ca",
  "clientLeafCertValidity": "NotBefore=2025-11-27T10:18:17Z;NotAfter=2025-12-04T10:18:17Z",
  "connectionLogCustomData": "REVOKED:01:e5:f0:60:df:9a:92:dd:40:c7:31:61:2e:72:7b:ae:0e:20:00:b9"
}

{
  "eventTimestamp": 1764324406448,
  "connectionId": "K85pU88FYUohutYb1vpTJdxdoW8LMTik5lqCmmyBllkVXHevWVR_kA==",
  "distributionId": "ELGQOVCCUO3ME",
  "connectionStatus": "Success",
  "clientIp": "44.220.54.32",
  "clientPort": "37594",
  "serverIp": "108.138.85.20",
  "distributionTenantId": "-",
  "tlsProtocol": "TLSv1.3",
  "tlsCipher": "TLS_AES_128_GCM_SHA256",
  "tlsHandshakeDuration": 64,
  "tlsSni": "www.non-97.net",
  "clientLeafCertSerialNumber": "72:ef:fd:8b:79:26:e7:11:d1:36:f2:80:f0:61:75:82:90:34:d7:d5",
  "clientLeafCertSubject": "C=JP,%20ST=Tokyo,%20L=Default%20City,%20O=Default%20Company%20Ltd,%20CN=Test%202",
  "clientLeafCertIssuer": "C=JP,%20ST=Tokyo,%20L=Default%20City,%20O=Default%20Company%20Ltd,%20CN=root-ca",
  "clientLeafCertValidity": "NotBefore=2025-11-28T09:52:08Z;NotAfter=2025-12-05T09:52:08Z",
  "connectionLogCustomData": "Valid%20certificate:%2072:ef:fd:8b:79:26:e7:11:d1:36:f2:80:f0:61:75:82:90:34:d7:d5"
}