Question

A financial services company runs an Azure Application Gateway v2 in front of a REST API used by partner organizations. Compliance requires that only partner client applications presenting a valid client certificate issued by an approved certificate authority be allowed to connect; any request without a trusted client certificate must be rejected at the gateway. Which Application Gateway configuration meets this requirement?

Accepted Answer

Configure mutual TLS (mTLS) authentication on the listener by uploading the client CA certificate chain to an SSL profile and associating that profile with the listener.

Answer

Enable end-to-end TLS by uploading the backend server's root certificate to the HTTP settings so the gateway validates the backend.

Answer

Add a rewrite rule set that inspects the X-ARR-ClientCert request header and drops requests where the header is missing.

Answer

Configure a custom health probe with a match condition that requires the client certificate thumbprint in the response body.