Application Gateway SSL Certificates

This document provides a comprehensive guide to managing SSL certificates with Azure Application Gateway. Secure your web applications by understanding how to upload, manage, and utilize SSL certificates for encrypted traffic.

Overview of SSL/TLS with Application Gateway

Application Gateway supports SSL termination at the gateway, allowing you to offload SSL decryption from your backend servers. This simplifies certificate management and reduces the processing load on your applications. When a client connects to the Application Gateway using HTTPS, the gateway decrypts the traffic using the configured SSL certificate and then forwards the unencrypted traffic to the backend servers. For enhanced security, you can also configure end-to-end SSL encryption, where traffic remains encrypted between the gateway and the backend.

Types of SSL Certificates Supported

Application Gateway supports the following types of SSL certificates:

• PFX files (PKCS #12): This is the most common format and contains both the public certificate and its corresponding private key. It's essential for SSL termination.
• Public Certificates (CER files): These are used for end-to-end SSL encryption where the gateway needs to trust the backend server's certificate, but the gateway itself doesn't need the private key.

Uploading SSL Certificates

You can upload your SSL certificates to Application Gateway through the Azure portal, Azure CLI, or PowerShell.

Using the Azure Portal

1. Navigate to your Application Gateway resource in the Azure portal.
2. In the left-hand menu, select Certificates under Settings.
3. Click on Add certificate.
4. Provide a name for the certificate.
5. Choose the Upload PFX certificate option.
6. Browse and select your PFX file.
7. Enter the Password for the PFX file.
8. Click Add.

Using Azure CLI

You can use the following Azure CLI command to upload a certificate:

az network application-gateway ssl-cert create --gateway-name <appGwName> --resource-group <resourceGroupName> --name <sslCertName> --upload-certificate-file <path/to/your/cert.pfx> --password <yourPfxPassword>

Configuring SSL Certificates for Listeners

Once uploaded, you can associate SSL certificates with the listeners on your Application Gateway. This is crucial for enabling HTTPS traffic.

Steps to Configure

1. In the Application Gateway settings, select Listeners.
2. Click on an existing listener to edit it, or select Add listener to create a new one.
3. For the Protocol, select HTTPS.
4. Under HTTPS settings, choose the SSL certificate you uploaded from the Choose certificate dropdown.
5. If you are using a certificate from Azure Key Vault, select Choose from Key Vault and configure the Key Vault settings.
6. Configure other listener settings as required (e.g., Port, Hostname, Listener type).
7. Click Add or Save.

Managing Certificates from Azure Key Vault

For enhanced security and simplified management, you can store your SSL certificates in Azure Key Vault and link them to your Application Gateway. This allows for centralized certificate management and automatic rotation.

Benefits of using Key Vault:

• Centralized management of secrets.
• Automated certificate renewal and rotation.
• Improved security by avoiding direct handling of private keys.

Steps to Integrate with Key Vault:

1. Ensure your certificate is stored in Azure Key Vault.
2. Grant the Application Gateway's managed identity permissions to read secrets from the Key Vault.
3. When creating or editing an Application Gateway listener, select Choose from Key Vault.
4. Select your Key Vault, the Certificate, and the Secret version.

SSL Policy Configuration

Application Gateway allows you to configure an SSL policy to control the minimum SSL/TLS version and cipher suites that clients can use to connect. This helps you enforce modern security standards.

SSL Policy Options:

• Minimum TLS version: Choose from TLSv1_0, TLSv1_1, or TLSv1_2. It is recommended to use TLSv1_2 for maximum security.
• Cipher Suites: You can select predefined policies (e.g., AppGwSslPolicy20170401) or create a custom policy to specify allowed cipher suites.

Best Practices

• Always use strong, up-to-date SSL certificates from trusted Certificate Authorities (CAs).
• Regularly rotate your SSL certificates to ensure security.
• Leverage Azure Key Vault for secure and centralized certificate management.
• Configure the most restrictive SSL policy possible (e.g., TLSv1_2) to protect against older, less secure protocols.
• Use end-to-end SSL encryption if your backend applications also support HTTPS and you need to protect data within your virtual network.

By implementing these SSL certificate management strategies with Azure Application Gateway, you can significantly enhance the security posture of your web applications.