Difference between HTTP and HTTPs health probes in Azure Container Apps

@RajivBansal-2486 ,

In Azure Container Apps, both HTTP and HTTPS health probes are routed through the Envoy proxy, not directly to your container. This is true even for HTTP, which might seem counterintuitive at first. The Envoy proxy sits in front of your container and handles things like request routing, retries, metrics, and TLS termination (for HTTPS).

So when you configure an HTTPS health probe, it hits the Envoy proxy using TLS, and Envoy then forwards the request to your container over plain HTTP. Your container itself doesn’t need to handle HTTPS — that’s entirely managed by Envoy.

On the other hand, if you configure an HTTP probe, it also goes through Envoy — just without the TLS handshake — and still gets forwarded to your container over HTTP.

As for which to use:

HTTP is generally recommended unless you specifically need to validate that TLS is working properly at the Envoy layer (e.g., for compliance or testing HTTPS behavior).

Using HTTPS adds a bit of overhead and doesn’t provide additional security between Envoy and the container since that leg of the communication is still HTTP.

In short: both types of probes hit Envoy, and your container always sees plain HTTP. HTTPS is only necessary if you want to ensure the TLS layer is functioning as expected at the proxy level.

Hope this helps. Do let us know if you have any further queries.

If this answers your query, do click Accept Answer and Yes for "Was this answer helpful." And if you have any further questions, let us know.