Mutual TLS (mTLS), also known as client certificate
authentication, is now generally available on Azure Front Door Premium. Use
X.509 client certificates to help protect sensitive applications and APIs in
business-to-business, Internet of Things, financial services, and enterprise
scenarios.
Choose from four modes: require and validate, require
without validation, validate when presented, or pass through to the origin.
These modes let you control whether client certificates are mandatory and
whether Azure Front Door or your origin performs certificate validation. When
forwarded to the origin, the client certificate is provided in the
X-Azure-ClientCertificate request header.
General availability also simplifies trusted CA configuration. You can
upload only the trusted root CA certificate to Azure Key Vault and associate it
with your Front Door custom domain, without uploading intermediate CA
certificates. With this configuration, clients must present their client
certificate and all required intermediate certificates during the TLS
handshake. When edge validation is enabled, Azure Front Door builds and
validates the certificate chain at request time against the configured trusted
root CA.
Learn more.