How Azure Application gateway is using for multitenant Application - azure

Here We want to redirect application gateway to https we don't want to manually enter https to get on SSL.
We use the gateway for fabric we want all application on fabric using SSL.

Related

How to configure Service Fabric to support only HTTPS connections but not http?

I have Azure service fabric cluster created on local test environment & deployed microservice based web apis, it working well without any issues. But would like to enable HTTPS traffic on cluster level and want to stop HTTP requests
https://mytestsf.westus.cloudapp.azure.com:8800/ => expecting this one to work
http://mytestsf.westus.cloudapp.azure.com:8800/ => expecting this one NOT to work
Is Support only for HTTPS traffic can be done on Azure service fabric level? if yes, how?
P.S: This service fabric cluster not having any external network component like traffic manager or application gateway in front of it as it is local test environment.
Follow the documentation - add an HTTPS endpoint using Kestrel - Azure Service Fabric.

Azure application gateway with app service - https listener using app service

In Azure I've an application gateway connected with a backend-pool with an Azure app service. This Azure app service accepts http and https traffic.
I added an http listener and created a rule to redirect http traffic to backend pool. This is working fine.
However I would like to do the same with https protocol. But when I'm trying to add the https listener I'm requested to add the pfx certificate. This is expected obviously. But in this case I would like to redirect the https traffic to the Azure App Service which has configured https access, and there is no way (that I know) to export Azure App Service certificate.
Do you know if there is a way to redirect https traffic on an application gateway to an Azure App Service without the certificate "trusting" only on Azure App Service?
Thanks,
Would it help you if you had an exported copy of your app service certificate? If so, you can do so by going to portal.azure.com> app service certs> select your cert> select the export certificate blade > select open key vault secret> select the current version of your cert> select "download as a certificate.

How to add HTTPS/SSL support to a microservice via Azure API management layer without app server having to support SSL?

I have a Azure APIM setup that receives the website request and forwards it to the respective microservice node. The website supports only http requests and now I wish to change this to HTTPS/SSL.
The app server on the microservice node does not support SSL, so I have couple of options:
On microservice node - change to another app server that supports SSL
OR On microservice node - Add a web server (nginx) which does the SSL and forwards the request to the app server (both web server and app server will be on the same node)
OR Configure SSL at the Azure API management layer
I prefer to use option 3 so that the microservice node is responsible only to serve requests and the HTTPS/SSL bit is handled by the Azure API management layer. This documentation seems to suggest how this can be achieved for both SSL termination at the gateway and end to end SSL. However, there are 2 problems:
This article is about application gateway - and I am looking for similar solution with API management (API gateway).
If I wish to use the end to end SSL mode, and not the SSL termination mode (which terminates SSL at gateway), then my app server will need to have SSL feature?
How to add end to end SSL support to a microservice via Azure API management layer without app server having to support SSL?
API Management (APIM) is acting as a reverse proxy - much like nginx in your example. APIM supports SSL by default and can do SSL termination.
APIM will also talk to your backend service without without any issues - all you need to do is select "http" for the backend instead of "https".

Let's Encrypt Certificate in Azure Web App for Containers with Custom Domain

My goal is to create an Azure Web App for Containers, map a custom domain to it and secure this domain with an SSL certificate from Let's Encrypt which is automatically renewed every month.
So far I have successfully configured a docker-compose for the web app:
Nginx which handles Let's Encrypt certificate renewals and https redirections
Web App to which Nginx proxies to
Also, I successfully mapped my domain to the Azure Web App.
But there is a problem. It seems Azure is applying some certificates on its own. When I want to use the Web App from my browser, the certificate for *.azurewebsites.net is served:
Can I somehow disable SSL for the Azure Web App for Containers so that my Nginx proxy is responsible for this or use Let's Encrypt in some other way? I know that for the Windows-Based Web Apps there is a Let's Encrypt extension, but there is no one for Azure Web App for Containers.

Client certificate with Azure Application Gateway

I have two VMs with IIS that host my application with Azure Application Gateway distributing the traffic. The gateway is configured to offload SSL and everything is working fine.
However, I'd like to use client certificate authentication on one of the paths of the application - on NetScaler (or some other load balancer) I'd simply put serialized client certificate into HTTP Header (X-Client-Cert).
Can I do something similar with Application Gateway?
At the moment thats not possible, but is in the pipeline of product development of the azure product team.

Resources