Public Preview: Azure Front Door mutual TLS

Mutual TLS, also known as client certificate authentication, enables Azure Front Door to authenticate clients using X.509 certificates before requests reach an application. It helps protect sensitive applications and APIs across business-to-business, Internet of Things, financial services, VPN, and enterprise network scenarios.

Customers can choose from four client certificate validation modes:

• Require and validate: A client certificate is mandatory. Azure Front Door validates the certificate at the edge and forwards it to the origin in the X-Azure-ClientCertificate request header.
• Require without validation: A client certificate is mandatory, but Azure Front Door does not validate it. The certificate is forwarded in the X-Azure-ClientCertificate header for validation by the origin.
• Validate when presented: A client certificate is optional. When a certificate is presented, Azure Front Door validates it and forwards it to the origin. Requests without a certificate are allowed to continue.
• Pass through to the origin: A client certificate is optional. Azure Front Door does not validate it but forwards it to the origin when presented, allowing the origin to perform validation.

Azure Front Door supports client certificates issued by public and private certificate authorities. Customers upload the trusted certificate authority chain to Azure Key Vault and associate it with a Front Door custom domain.

Learn more.