Configure TLS - Learn Tech From Zero

3.2 Azure Application Gateway

📘Microsoft Azure Networking Solutions (AZ-700)

TLS (Transport Layer Security) is the protocol that encrypts data sent between clients (like web browsers) and servers. Configuring TLS in Azure Application Gateway ensures that all web traffic is secure, protecting sensitive data like login credentials, personal info, or corporate data.

1. What TLS Does in Application Gateway

Encrypts traffic: Ensures that data between users and your web application is not readable by outsiders.
Authentication: Confirms that the client is connecting to the correct server (not a fake or malicious server).
Integrity: Ensures that data hasn’t been changed in transit.

In Azure, Application Gateway acts as a reverse proxy, meaning it receives client requests first and forwards them to your backend servers. TLS ensures this communication is secure.

2. TLS Termination and End-to-End TLS

When configuring TLS in Application Gateway, there are two main approaches:

TLS Termination (HTTPS Listener):
- Application Gateway decrypts HTTPS traffic from clients at the gateway.
- Backend servers receive plain HTTP traffic.
- Advantage: Offloads encryption work from backend servers, improving performance.
- Common in environments where internal traffic is trusted.
End-to-End TLS:
- Application Gateway decrypts traffic, then re-encrypts it before sending to the backend servers.
- Backend servers also use HTTPS.
- Advantage: Provides encryption all the way to the backend, which is ideal for highly sensitive data.

Exam Tip: Know the difference between TLS Termination and End-to-End TLS because questions often ask which scenario suits which approach.

3. Configuring TLS in Azure Application Gateway

Step 1: Create or Update an HTTPS Listener

Go to your Application Gateway in the Azure Portal.
Navigate to Listeners → Click + Add Listener.
Set Protocol to HTTPS.
Assign a Frontend IP (Public or Private, depending on your setup).
Choose a Frontend Port, usually 443 for HTTPS.

Step 2: Upload SSL/TLS Certificate

You need an SSL certificate issued by a trusted Certificate Authority (CA) or a self-signed certificate for testing.
In the portal:
- Under Listener → HTTPS, upload the .pfx file.
- Enter the password for the certificate.
This certificate is what the gateway uses to encrypt traffic.

Step 3: Bind Listener to a Backend Pool

After the listener is created, you need a HTTP/HTTPS routing rule.
Define which backend pool receives the traffic.
Choose Use HTTPS for backend communication if you want end-to-end TLS.

Step 4: Optional – Enable TLS Policies

TLS policies control protocol versions and cipher suites to enforce security standards.
For example:
- TLS 1.2 is widely used and considered secure.
- TLS 1.0 or 1.1 should be disabled due to vulnerabilities.
Azure provides Predefined and Custom policies.
- Predefined: Quickly apply secure defaults.
- Custom: Choose specific protocols and ciphers.

4. Testing TLS Configuration

After configuration, test the Application Gateway using a browser:
- Type https://your-app-gateway-url.
- Ensure the browser shows a secure lock icon.
You can also use tools like:
- OpenSSL to check supported TLS versions.
- SSL Labs online scanner to test certificate and TLS security.

5. Important Exam Points

Application Gateway requires a certificate for HTTPS listeners.
TLS Termination vs End-to-End TLS:
- Termination: Decrypts at gateway, backend HTTP.
- End-to-End: Decrypts and re-encrypts, backend HTTPS.
TLS Policies enforce protocol version and cipher suites.
Always use TLS 1.2 or higher for security.
Self-signed certificates are for testing only, not production.

6. Real IT Environment Example

In an IT environment:

A company hosts a web app on Azure VMs.
Azure Application Gateway is in front of the VMs.
TLS Termination allows the gateway to handle encryption, reducing load on the VMs.
If the data is highly sensitive (like banking info), the company uses End-to-End TLS to ensure encryption continues all the way to backend servers.

✅ Summary Table for Exam:

Feature	TLS Termination	End-to-End TLS
Decrypt at Gateway	Yes	Yes
Re-encrypt to backend	No	Yes
Backend protocol	HTTP	HTTPS
Use case	Performance-focused	Security-focused
Required Certificate	Yes	Yes

This section for the AZ-700 exam focuses on:

Creating HTTPS listeners
Uploading and managing certificates
Choosing the correct TLS approach (termination vs end-to-end)
Configuring TLS policies