Generally Available: Azure Front Door mutual TLS authentication

Mutual TLS (mTLS), also known as client certificate authentication, is now generally available on Azure Front Door Premium. Use X.509 client certificates to help protect sensitive applications and APIs in business-to-business, Internet of Things, financial services, and enterprise scenarios.

Choose from four modes: require and validate, require without validation, validate when presented, or pass through to the origin. These modes let you control whether client certificates are mandatory and whether Azure Front Door or your origin performs certificate validation. When forwarded to the origin, the client certificate is provided in the X-Azure-ClientCertificate request header. General availability also simplifies trusted CA configuration. You can upload only the trusted root CA certificate to Azure Key Vault and associate it with your Front Door custom domain, without uploading intermediate CA certificates. With this configuration, clients must present their client certificate and all required intermediate certificates during the TLS handshake. When edge validation is enabled, Azure Front Door builds and validates the certificate chain at request time against the configured trusted root CA.

Learn more.