我正在尝试将Api Gateway与我的api连接在Elastic Beanstalk中.我希望我的api只能通过Api Gateway访问,为此我在后端使用客户端SSL证书授权(比如这个aws发布链接：http://docs.aws.amazon.com/es_es/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html).所以我的建筑是这样的：

API GATEWAY-> ELASTIC LOAD BALANCER-> EC2(ELASTIC BEANSTALK)

我的EC2机器有Nginx和Ruby.

连接的工作方式如下：

API GATEWAY – > (80 PORT) – > ELASTIC LOAD BALANCER – > (443 PORT) – > Nginx – >ruby

我在Nginx中做客户端身份验证.
当我使用浏览器访问Elastic Load Balancer时,它显示400 Bad Request – Nginx错误：没有发送所需的SSL证书(这是正确的,因为我没有发送证书).但是,当我使用Api网关访问并发送客户端证书时,我得到了同样的错误(我不明白为什么).

当我在Nginx中配置SSL连接时,我使用的是我签名的SSL证书(可能这是问题吗？)

我的问题的其他可能原因是Elastic Load Balancer中的端口配置(在图片中).我有后端身份验证：已禁用.这是一个问题吗？
Pictura Port Config ELB

我的Nginx配置是：

upstream my_app {
  server unix:///var/run/puma/my_app.sock;
}

log_format healthd '$msec"$uri"'
                '$status"$request_time"$upstream_response_time"'
                '$http_x_forwarded_for';

server {
listen       443 ssl;
listen       [::]:443 ssl;
server_name  localhost;
root         /usr/share/Nginx/html;

ssl on;
ssl_certificate /etc/Nginx/ssl/dev.crt;
ssl_certificate_key /etc/Nginx/ssl/dev.key;
ssl_trusted_certificate /etc/Nginx/ssl/api-gateway.pem;
ssl_client_certificate /etc/Nginx/ssl/api-gateway.pem;
ssl_verify_client on;

ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
ssl_prefer_server_ciphers on;
if ($ssl_client_verify = Failed) {
        return 495;
}
if ($ssl_client_verify = NONE) {
    return 402;
}
if ($ssl_client_verify != SUCCESS) {
    return 403;
}
try_files $uri/index.html $uri @my_app;
  location @my_app {
    proxy_set_header  Host $host;
    proxy_set_header  X-Real-IP $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Host $server_name;
    proxy_set_header  Client-IP $remote_addr;
            proxy_pass        http://my_app;
    proxy_set_header X-Client-Verify $ssl_client_verify;
  }
# Load configuration files for the default server block.
include /etc/Nginx/default.d/*.conf;
location / {
    proxy_pass http://my_app; # match the name of upstream directive which is defined above
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header gonzalo1 $ssl_client_verify;
}
error_page 404 /404.html;
    location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
    location = /50x.html {
}

}