Generally Available: Keyless TLS on Application Gateway with Azure Key Vault Managed HSM
- Feed
- Azure Updates · original
- Microsoft id
577130- Availability
- General Availability: October 2026
- Tags
- Features, Networking, Security
- First captured by us
- Microsoft last modified
Description
Azure Application Gateway now supports keyless TLS termination using certificates whose private keys stay in Azure Key Vault Managed HSM. Each TLS handshake signature is performed inside the HSM, and the private key is never exported to the gateway.
This integration helps you:
- Maintain private key custody within a dedicated HSM boundary.
- Use managed identities and role-based access control for key access.
- Monitor signing operations through Managed HSM diagnostic logs.
- Obtain cryptographic evidence that the TLS key was generated and is stored in a FIPS 140-3 Level 3 validated HSM.
- Support separation of duties and centralized key management.
Learn more:
- What is keyless TLS for Azure Application Gateway and Azure Key Vault Managed HSM?
- Tutorial: Configure keyless TLS termination with Azure Key Vault Managed HSM
- What is Azure Key Vault Managed HSM?
Quoted from Azure Updates (source). Reproduced for reporting and archival purposes.
What Microsoft changed
We have seen one version of this item so far. If Microsoft edits it, the earlier version stays here with the difference highlighted.