Can the Application Gateway passthrough a client certificate so it can be recognised by APIM?

Accepted answer

Andriy Bilous 11,426 Reputation points MVP

2022-01-21T20:52:42.867+00:00

Hello @gaur

Application Gateway allows you to add, remove, or update HTTP request and response headers while the request and response packets move between the client and back-end pools.

You are using Mutual Authentication and have set your SSL profile to mutually validate client request, but the request sent to the APIM does not consists of X-ARR-ClientCert header.

Application Gateway can passthrough a client certificate but you need to rewrite HTTP header with a Custom Header name X-ARR-ClientCert with value {var_client_certificate} in Application Gateway.

As the Mutual Authentication is still in preview some features might not work as expected and it is currently not recommended for production environments.

https://stackoverflow.com/questions/69166457/azure-application-gateway-client-certificates-headers

https://learn.microsoft.com/en-us/answers/questions/554635/azure-application-gateway-client-certificates-head.html
Please sign in to rate this answer.

1 person found this answer helpful.
Aliaksei Krylou 1 Reputation point

2022-10-19T15:24:06.877+00:00

Can someone please share a detailed guide on how to configure this rewrite in App Gateway so it will send the client certificate to API Management?

Maciej Kopeć 0 Reputation points

2023-06-07T19:05:38.21+00:00

What about the scenario where you would like to validate client certificate on APIM e.g. using validate-client-certificate policy or by accessing context variable in expression? Do I understand it correctly that there is no such option? And that in such case if you access context data in apim policy context.Request.Certificate will be always null?

FranRomero-7950 0 Reputation points

2024-05-16T12:05:06.5033333+00:00

Hi! I'm having a similar issue but with the WAF. It seems not to recognize any rewrite variables, only the ones visible from the browser, so it doesn't allow me to filter certificate data through the WAF. Is there any way to filter certificate data through the WAF? I can't access any variables. Thanks, regards.

Chip Steen 0 Reputation points

2024-07-25T23:58:57.3533333+00:00

Hello!

You are able to pass the certificate to your APIM via rewrite rules BUT LET ME TELL YOU.....You MUST have SSL profile with client CA attached to your listener or your APIM instance will have empty headers.

good luck!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Can the Application Gateway passthrough a client certificate so it can be recognised by APIM?

0 additional answers

Your answer