Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
656 questions
Client SSL Certificate Passthrough to server in Azure Firewall premium?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 93%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPS%3C/text%3E%3C/svg%3E)
Pattamadai, Sundar
21
Reputation points
Hello,
We are moving some web services that run on IIS and have SSL Setting to 'Require' Client certificate. The callers of our service provide a ssl client certificate and that must be passed through by the loadbalancer to the backend server/VM. In short, whatever certificate the caller provided must be made available to the backend server. F5 allows this today.
What loadbalancer offering in Azure can satisfy this use case? (without code changes to our existing services, some wcf and some webapi running on IIS on VMs)
- App Gateway I see can makes the caller provided certificate available via a header variable. But that is not pass through and would require us to make changes in our services to get the certificate from a header variable.
- Can Azure Premium firewall do what we want?
..OR do we have to resort to standing up F5 in azure VM?
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 59%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
ChaitanyaNaykodi-MSFT 25,856 Reputation points Microsoft Employee2022-10-21T03:52:16.277+00:00 @Pattamadai, Sundar ,
Thank you for reaching out and Welcome to the Microsoft Q&A forum.As mentioned here in premium features documentation, Azure Firewall premium does not provide Inbound TLS Inspection. As per this statement you should be able to do a Client SSL Certificate pass through.
I am reaching out to the team internally to confirm this. I will let you know once I get a response back. Thank you!
Sign in to comment
Sign in to answer