Mutual TLS, also known as client
certificate authentication, enables Azure Front Door to authenticate clients
using X.509 certificates before requests reach an application. It helps protect
sensitive applications and APIs across business-to-business, Internet of
Things, financial services, VPN, and enterprise network scenarios.
Customers can choose from four client
certificate validation modes:
- Require and validate: A client
certificate is mandatory. Azure Front Door validates the certificate at
the edge and forwards it to the origin in the X-Azure-ClientCertificate
request header.
- Require without validation: A
client certificate is mandatory, but Azure Front Door does not validate
it. The certificate is forwarded in the X-Azure-ClientCertificate header
for validation by the origin.
- Validate when presented: A client
certificate is optional. When a certificate is presented, Azure Front Door
validates it and forwards it to the origin. Requests without a certificate
are allowed to continue.
- Pass through to the origin: A
client certificate is optional. Azure Front Door does not validate it but
forwards it to the origin when presented, allowing the origin to perform
validation.
Azure Front Door supports client
certificates issued by public and private certificate authorities. Customers
upload the trusted certificate authority chain to Azure Key Vault and associate
it with a Front Door custom domain.
Learn more.