Azure Application Gateway client certificate passthrough

Question

In a set up where an Azure App Service has two paths, for example /api and /auth, and Client Certificate Mode is set to Require with Path Exclusion set to /api, meaning the App Service will require mutual TLS authentication for the /auth route, can the Application Gateway which is fronting this App service with end-to-end TLS, passthrough the client certificate from the incoming request when the path is /auth?

One possible way to do this is by enabling Mutual Authentication in Application Gateway and using HTTP rewrite Headers to set some new custom Header like X-Client-Cert to the variable {var_client_certificate), however, it seems this is done with an SSL Profile and it has to be associated with a particular Listener which makes it enforceable for the whole Listene ?. In this case, is it required that we set up two listeners pointing to the same App Service backend pool, one with the SSL Profile and the other with no SSL Profile and use two different CNAMEs for the listeners? Something like api[dot]domain[dot]com and auth[dot]domain[com]?

Is it possible to set up an SSL Profile with an exclusion Path or enforce the SSL Profile on a Listener only for a specific Path, like /auth in this example?

Answer 1

You can't configure app to require a certificate only on certain paths. See this https://learn.microsoft.com/en-us/aspnet/core/security/authentication/certauth?view=aspnetcore-6.0#can-i-configure-my-app-to-require-a-certificate-only-on-certain-paths