Access Denied error on mutual authentication in Application Gwateway v2 and Azure App Service

Question

Ref1: https://www.starwindsoftware.com/blog/mutual-tls-mtls-or-client-certificate-authentication-with-an-azure-application-gateway-and-an-app-service-application

ref2: https://learn.microsoft.com/en-us/azure/application-gateway/mutual-authentication-powershell

I've implemented mutual (certificate) authentication and I hosted my app on the Azure App service. When I open directly my app URL https://apptemp.azurewebsites.net/swagger/index.html and then select client certificate, the app works well and I see my app page.

Now, I've added an Azure Application Gateway V2 ( without WAF) with the below configuration.

1. I configure this item on my web app
   
2. I added a backend pool to my web app
   
3. I configure the backend HTTP setting
   
4. Create an SSL profile with a Public certificate that is exported from the root certificate. The root certificate was uploaded to the server.
   
5. I added a listener
   
6. In the health probe with the below config.
   

for the resulting test, I received this error

Received invalid status code: 403 in the backend server’s HTTP response. As per the health probe configuration, 200-399 is the acceptable status code. Either modify probe configuration or resolve backend issues.  

And also I received the 502 bad gateway when I open the test.mydomain.com URL.

7. I changed HTTP response status code match to 200-403 and then I received Healthy status.
   

But when I open the test.mydomain.com URL I received the below error.

Really I am confused that what is the problem :(

Answer 1

@Mohsen Akhavan ,

Welcome to the Microsoft Q&A forum. Based on the documentation here
Can you please confirm that there is a root CA certificate in the client certificate that you have uploaded? If you've uploaded a certificate chain with root CA and intermediate CA certificates, the certificate chain must be uploaded as a PEM or CER file to the gateway.
From the screenshots above I can see that you have enabled Verify client certificate DN based on the scenario's mentioned here can you please confirm if the issue not due DN verification.
You can also follow this troubleshooting document for additional help. Thank you!