Question

Your company deploys an Azure Firewall Premium instance to inspect outbound HTTPS traffic from application servers. You configure a firewall policy with TLS inspection enabled on an application rule collection. The intermediate CA certificate must be presented by the firewall to clients so it can decrypt and re-encrypt sessions. What must you configure so the firewall can perform TLS inspection?

Accepted Answer

Store an intermediate CA certificate in an Azure Key Vault and grant the firewall policy's managed identity access to it

Answer

Upload a self-signed leaf (server) certificate directly into the firewall policy's TLS inspection settings

Answer

Add the public root certificate of each destination website to the firewall's trusted root store

Answer

Enable IDPS in alert-and-deny mode, which automatically generates the required inspection certificate