0

Ref1: enter link description here

Ref2: enter link description here

I've implemented mutual (certificate) authentication and I hosted my app on the Azure App service. When I open directly my app URL https://apptemp.azurewebsites.net/swagger/index.html and then select client certificate, the app works well and I see my app page.

enter image description here

Now, I've added an Azure Application Gateway V2 ( without WAF) with the below configuration.

  1. I configure this item on my web app

enter image description here

  1. I configure the backend HTTP setting

enter image description here

  1. Create an SSL profile with a Public certificate that is exported from the root certificate. The root certificate was uploaded to the server.

enter image description here

  1. I added a listener

enter image description here

  1. In the health probe with the below config.

enter image description here

for the resulting test, I received this error:

Received invalid status code: 403 in the backend server’s HTTP response. As per the health probe configuration, 200-399 is the acceptable status code. Either modify probe configuration or resolve backend issues.

And also I received the 502 bad gateway when I open the test.mydomain.com URL.

enter image description here

  1. I changed HTTP response status code match to 200-403 and then I received Healthy status.

enter image description here

But when I open the test.mydomain.com URL I received the below error.

enter image description here

Really I am confused that what is the problem :(

Shadi
  • 193
  • 2
  • 12

2 Answers2

0

I tried to reproduce the same in my environment and got the results successfully.

I created app service with host https://staxxx.azurewebsites.net/imran/index.html as same.

enter image description here

Added backend pool: enter image description here

I have created two backend setting with http port 80 and https port 443 like below ...custom probes automatically added when you are creating probes.

enter image description here

And try to update SSL profile with client authentication and ssl policy like below.

enter image description here enter image description here

While creating application gateway I created listener 1 with HPPT 80 and now I added listener 2 with port 443 along with sample host name.

enter image description hereenter image description here

While creating app gateway I created rule 1 with listener 1 with path base and then I create another rule with listener 2 with same backend target and setting like below.

enter image description here

Now I added rule 2 with listener 2 with same backend target and setting... So, my ssl certificate will be integrate to listener 2 and listener to http and it will establish a connection to the backend targets.

Added healthy probes

enter image description here

Now, when I try to redirect it's work successfully like below

https://your domain/azurewebsites.net/imran/index.html

enter image description here

Imran
  • 3,875
  • 2
  • 3
  • 12
  • Thanks for your comment. I have a question about the SSL Policy. Is it mandatory? I didn't enable it. – Shadi Nov 13 '22 at 18:34
  • Not mandatory SSL policies allow you to configure specific listener try in both ways also. – Imran Nov 14 '22 at 09:25
0

It looks like you are attempting to perform mTLS through the App Gateway to your backend App Service. Understand that there are two TLS connections being performed here, one between the client and the App Gateway, and one between the App Gateway and your App Service. No setting in App Gateway's configuration for SSL or certificates will affect both of these connections; they only affect the listener side or the backend side.

The App Gateway is not capable of performing mTLS as a client to a backend service. The only mTLS related function with App Gateway is for clients to connect it using a trusted client certificate and this does not affect the TLS sessions on the backend.

There is a workaround to get this to work with headers, but I would first consider if it's acceptable to just do mTLS on your App Gateway's frontend and have a regular TLS session being done on the backend to the App Service. If so, you can see how to configure this here: https://learn.microsoft.com/en-us/azure/application-gateway/mutual-authentication-overview

If you want something close to End-to-End mTLS, the best way to accomplish this is using header rewrite as the PEM data from a client certificate can be obtained with the "var_client_certificate" variable. You can place this data in a header for your server to read. The downside is your backend server's code will need rewriting to authenticate using the header data against the issuing authority instead of during the TLS handshake. For header rewrites reference this document here: https://learn.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-portal

DusDee
  • 136
  • 1
  • 5