Announcing a new mTLS enhancement in Azure Application Gateway for backend applications that perform client certificate and authorization header validation at the backend while still requiring web traffic inspection through the Web Application Firewall (WAF). This update introduces greater flexibility by allowing such applications to accept and inspect traffic through the Application Gateway even when a client certificate is not presented, supporting mixed authentication scenarios with both mTLS and token-based access.
What Changed
Previously, Application Gateway listeners operated in Strict mode, blocking any connection without a valid client certificate. This meant traffic relying solely on authorization tokens could not reach the backend.
With this update, you can now enable Passthrough mode for mutual TLS (mTLS) connections, allowing:
- Requests without client certificates to pass through WAF for inspection.
- Backend applications to retain full control over certificate and token validation logic.
Learn more.