Azure Application Gateway Now Supports mTLS and OCSP

Published on march 1, 2023

With the release of its Azure Application Gateway, Microsoft has announced that it now supports mutual Transport Layer Security (mTLS) and Online Certificate Status Protocol (OCSP).

mTLS ensures that both the server and client authenticate each other before establishing a secure connection. Additionally, OCSP checks the status of digital certificates in real time, reducing the risk of cyber attacks. The implementation of mTLS and OCSP in Azure Application Gateway enhances security, improves compliance, and reduces the risk of cyberattacks.

It provides an additional layer of security, ensuring that the authenticity of both the client and server is verified, making it more secure than TLS.

The Application Gateway supports certificates issued by both public and private certificate authorities. In addition, it supports TLS termination at the gateway, which improves performance and reduces the load on the backend servers.

OCSP support in the application gateway enables users to send a client certificate to the backend application server for auditing purposes or for providing tokens or cookies to a client certificate. Users can accomplish this by setting up a rewrite rule that sends the client certificate as an HTTPS header.

Furthermore, OCSP support allows users to verify the status of the client certificate in real time. By ensuring that the current certificate is valid and has not been compromised, this can prevent man-in-the-middle attacks.

Customers must configure their backend servers with certificates signed by trusted authorities in order to enable mTLS and OCSP on Application Gateway. Additionally, they must upload their root or intermediate CA certificates to Application Gateway.

Specifically, Microsoft recommends mTLS:

When communicating between Internet of Things (IoT) devices, each device presents its certificate for authentication.

Making API communication between microservices more secure and preventing malicious APIs from communicating with them.

Defending against attacks such as brute force or credential stuffing.

Through the SSL settings tab in the portal, users can configure mTLS after provisioning an Azure Application Gateway or configuring an existing one. Alternatively, they may use PowerShell.

Lastly, more information on Azure Application Gateway can be found in the documentation pages and FAQs.