Okta Access Gateway AWS Firewall Domain Allowlist
Last Updated:
Overview
Okta Access Gateway (OAG) fails to establish a Transport Layer Security (TLS) connection through an Amazon Web Services (AWS) firewall because the appliance does not send the Server Name Indication (SNI) field by default. Resolve this by adding the required proxy directives to the root application policy.
When attempting to establish a Transport Layer Security connection, the Okta Access Gateway appliance does not send the Server Name Indication field in the client hello packet by default.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Access Gateway (OAG)
- Amazon Web Services (AWS)
Cause
According to the AWS documentation, the Amazon Web Services (AWS) Network Firewall uses the Server Name Indication (SNI) extension in the Transport Layer Security (TLS) handshake to determine the hostname or domain name. Okta Access Gateway does not enable the directives required to send the Server Name Indication field by default.
Solution
How does Okta Access Gateway send the Server Name Indication field to the AWS firewall?
Enable the Server Name Indication field by adding the required proxy directives under the root application policy.
- Add the following directives under the root application policy.
proxy_ssl_name $host;
proxy_ssl_server_name on;
