Azure Site-to-Site VPN with digital certificate
authentication provides an alternative to the traditional pre-shared key (PSK)
model by using a certificate-based asymmetric trust model. In this
configuration, Azure and the on-premises VPN device authenticate each other by
using separate inbound and outbound certificates. The outbound authentication
certificate is stored in Azure Key Vault and is accessed by the VPN Gateway
through a user-assigned managed identity with the required Role-Based Access
Control (RBAC) permissions. Because X.509 certificates use asymmetric keys and
a trusted certificate chain to validate identity, this approach helps reduce
the risk of impersonation and Internet Key Exchange (IKE) negotiation
tampering.
Learn more.