# Amazon API Gateway Now Supports Mutual TLS for Backend Integrations Too!

Hey, it's me, Shiichan! Today's news is about another layer of trust for your APIs.

## What was announced?

AWS What's New announced that Amazon API Gateway REST APIs can now present an AWS Certificate Manager (ACM) certificate to your backend during the TLS handshake, enabling mutual TLS (mTLS) between API Gateway and your backend.

## The story so far

Until now, API Gateway could only present a self-signed certificate that it generated itself. That meant your backend had no way to verify, using a trusted certificate authority, that a connection actually came from your API Gateway — a common requirement for a proper mTLS setup.

## What changes

Now you can use a certificate signed by a certificate authority you trust, and you have two ways to get one into ACM:

- Import a certificate from your existing public key infrastructure (PKI)
- Have ACM issue and manage one for you through AWS Private Certificate Authority

Your backend validates this certificate during the handshake to confirm the connection really comes from your API. When the certificate is reimported or renewed in ACM, API Gateway propagates the update automatically — no redeployment, no downtime.

Combined with the existing inbound mTLS support for client connections, you can now enforce mutual authentication on both legs — client-to-API and API-to-backend — which is a common requirement in financial services, healthcare, and other regulated or zero-trust environments.

## Dive Deep

Backend mTLS is available in all commercial AWS Regions and the AWS GovCloud (US) Regions where API Gateway REST APIs are available. You can configure it through the API Gateway console, AWS CLI, or AWS CloudFormation.

## Wrap-up

- Amazon API Gateway REST APIs now support mutual TLS for backend integrations
- You can move from self-signed certificates to CA-signed ACM certificates
- Certificate renewals propagate automatically — no redeployment or downtime
- Combine it with existing inbound mTLS for full mutual authentication on both legs
- Great for engineers in finance, healthcare, or zero-trust environments who need to verify backend connections too