Azure Application Gateway now supports keyless TLS
termination using certificates whose private keys stay in Azure Key Vault
Managed HSM. Each TLS handshake signature is performed inside the HSM, and the
private key is never exported to the gateway.
This integration helps you:
- Maintain
private key custody within a dedicated HSM boundary.
- Use
managed identities and role-based access control for key access.
- Monitor
signing operations through Managed HSM diagnostic logs.
- Obtain
cryptographic evidence that the TLS key was generated and is stored in a
FIPS 140-3 Level 3 validated HSM.
- Support
separation of duties and centralized key management.
Learn more: