Question

Your company runs a web application behind an Azure Application Gateway v2. Compliance requires that traffic remain encrypted from the client all the way to the backend servers (end-to-end TLS), not just to the Application Gateway. The backend pool consists of two VMs presenting certificates signed by your organization's private (internal) certificate authority. After configuring an HTTPS backend HTTP setting, the backend health shows 'Unknown' and requests fail. What must you configure so that the Application Gateway can establish trusted TLS connections to the backends?

Accepted Answer

Upload the backend server's root CA certificate as a Trusted Root Certificate in the backend HTTP setting

Answer

Upload the client-facing PFX certificate to the HTTPS listener and enable TLS termination

Answer

Disable the health probe and set the backend HTTP setting protocol to HTTP

Answer

Add the backend VMs' private IP addresses to the Application Gateway's public IP allow list