3.3 Azure Front Door

📘Microsoft Azure Networking Solutions (AZ-700)

1. Introduction to Azure Front Door and SSL

Microsoft Azure provides Azure Front Door, a global Layer 7 (HTTP/HTTPS) load balancer. It operates at the Microsoft edge network and routes user traffic to the closest and healthiest backend.

For the AZ-700 exam, you must clearly understand:

What SSL/TLS is
What SSL termination means
What end-to-end SSL encryption means
How Azure Front Door handles certificates
When to use each configuration

2. What is SSL/TLS?

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are protocols that:

Encrypt data between client and server
Protect sensitive data (passwords, tokens, API keys)
Prevent man-in-the-middle attacks
Provide server identity verification

Modern systems use TLS, but the term “SSL” is still commonly used.

In Azure Front Door, HTTPS uses TLS encryption.

3. SSL Termination in Azure Front Door

What is SSL Termination?

SSL termination means:

The client connects to Azure Front Door using HTTPS.
Azure Front Door decrypts the traffic at the edge.
Traffic from Azure Front Door to backend can be HTTP (unencrypted).

Traffic Flow

Client → HTTPS → Azure Front Door → HTTP → Backend

How It Works

Client sends HTTPS request.
Azure Front Door presents a certificate.
TLS handshake happens.
Traffic is decrypted at Azure Front Door.
Azure Front Door forwards request to backend over HTTP.

When to Use SSL Termination

Backend is inside private network (for example, internal App Service or VM).
You want lower backend CPU usage.
Backend does not support HTTPS.
Internal traffic security is handled separately (e.g., private network, VPN).

Benefits

Offloads encryption processing from backend servers.
Simplifies backend configuration.
Improves backend performance.
Centralized certificate management.

Risk Consideration

Traffic between Front Door and backend is unencrypted if HTTP is used.
This is less secure if backend is publicly accessible.

For exam:
If backend is public-facing, avoid HTTP between Front Door and backend.

4. End-to-End SSL Encryption

What is End-to-End SSL?

End-to-end SSL means:

HTTPS from client to Azure Front Door.
HTTPS from Azure Front Door to backend.

Traffic is encrypted throughout the entire path.

Traffic Flow

Client → HTTPS → Azure Front Door → HTTPS → Backend

Why Use End-to-End SSL?

Compliance requirements (PCI-DSS, HIPAA).
Zero-trust architecture.
Backend is exposed publicly.
High-security environments.

Backend Certificate Requirements

When using HTTPS to backend:

Backend must have a valid TLS certificate.
Certificate must match backend hostname.
Azure Front Door validates backend certificate.

If certificate is invalid:

Connection fails (unless certificate validation is disabled).

5. Frontend Certificates in Azure Front Door

Azure Front Door needs a certificate for the frontend (custom domain).

There are two options:

1. Azure-Managed Certificate (Recommended)

Azure automatically:

Issues certificate
Renews certificate
Manages lifecycle

Uses DigiCert under the hood.

Best for:

Simpler management
Public domains
No need to manually manage certificates

2. Bring Your Own Certificate (BYOC)

You upload your own certificate from:

Azure Key Vault

Requirements:

Certificate must be stored in Key Vault.
Front Door must have access to Key Vault.
Managed identity is used for access.

Used when:

Organization has its own CA.
Compliance requires specific certificate authority.
You need wildcard or EV certificates.

6. Backend Certificate Validation

When using HTTPS to backend:

Azure Front Door performs:

Certificate chain validation
Expiration check
Domain name validation

If certificate does not match hostname:
Connection fails.

For exam:
You must understand that backend certificate must match backend host name defined in Front Door configuration.

7. Enabling HTTPS in Azure Front Door (Configuration Steps)

Step 1: Add Custom Domain

Add domain (e.g., www.company.com)
Validate domain ownership

Step 2: Enable HTTPS

Choose Azure-managed certificate OR Key Vault certificate
Wait for provisioning

Step 3: Configure Backend Protocol

In backend pool:

Select HTTP or HTTPS

If selecting HTTPS:

Ensure backend supports TLS
Ensure certificate is valid

8. HTTP to HTTPS Redirection

Azure Front Door supports automatic redirect:

HTTP → HTTPS
Enforced at edge
Improves security

For exam:
You should know that redirection is configured using routing rules.

9. TLS Version Support

Azure Front Door supports:

TLS 1.2 (recommended)
TLS 1.3 (in modern tiers)

You can enforce minimum TLS version.

For security-focused exam questions:
Choose TLS 1.2 or higher.

10. Common Exam Scenarios

Scenario 1:

Backend does not support HTTPS.

Answer:
Use SSL termination (HTTPS at Front Door, HTTP to backend).

Scenario 2:

Compliance requires encryption across entire path.

Answer:
Use end-to-end SSL encryption.

Scenario 3:

Organization wants automatic certificate renewal.

Answer:
Use Azure-managed certificate.

Scenario 4:

Organization already stores certificates securely.

Answer:
Use Azure Key Vault integration.

Scenario 5:

Backend certificate mismatch error.

Reason:
Backend certificate CN/SAN does not match hostname defined in backend pool.

11. Security Best Practices for Exam

Always prefer HTTPS.
Use end-to-end SSL for public backends.
Use Azure-managed certificates unless specific requirement exists.
Store custom certificates in Azure Key Vault.
Enforce minimum TLS version 1.2.
Enable HTTP → HTTPS redirection.

12. Important Differences (Exam Summary Table)

Feature	SSL Termination	End-to-End SSL
Client to Front Door	HTTPS	HTTPS
Front Door to Backend	HTTP	HTTPS
Backend certificate required	No	Yes
Highest security	No	Yes
Backend CPU load	Lower	Slightly higher
Used for compliance	Usually No	Yes

13. Key Points to Remember for AZ-700

Azure Front Door terminates TLS at edge.
You can re-encrypt traffic to backend.
Certificates can be Azure-managed or Key Vault-based.
Backend certificate validation is important.
End-to-end encryption is required for strict security environments.
Use HTTPS redirect to enforce secure access.

Final Exam-Focused Summary

For the AZ-700 exam, you must clearly understand:

Difference between SSL termination and end-to-end SSL.
When to use HTTP vs HTTPS to backend.
Certificate management options.
Azure Key Vault integration.
Backend certificate validation behavior.
TLS version enforcement.
Security best practices.