Merge pull request #217052 from JackStromberg/patch-88

mTLS clarity changes

Author: v-regandowner

articles/application-gateway/mutual-authentication-overview.md

@@ -4,7 +4,7 @@ description: This article is an overview of mutual authentication on Application
 services: application-gateway
 author: greg-lindsay
 ms.service: application-gateway
-ms.date: 03/30/2021
+ms.date: 11/03/2022
 ms.topic: conceptual 
 ms.author: greglin
 
@@ -24,33 +24,31 @@ To configure mutual authentication, a trusted client CA certificate is required
 
 For example, if your client certificate contains a root CA certificate, multiple intermediate CA certificates, and a leaf certificate, make sure that the root CA certificate and all the intermediate CA certificates are uploaded onto Application Gateway in one file. For more information on how to extract a trusted client CA certificate, see [how to extract trusted client CA certificates](./mutual-authentication-certificate-management.md).
 
-If you're uploading a certificate chain with root CA and intermediate CA certificates, the certificate chain must be uploaded as a PEM or CER file to the gateway. 
+If you're uploading a certificate chain with root CA and intermediate CA certificates, the certificate chain must be uploaded as a PEM or CER file to the gateway.
+
+> [!IMPORTANT]
+> Make sure you upload the entire trusted client CA certificate chain to the Application Gateway when using mutual authentication. 
+
+Each SSL profile can support up to five trusted client CA certificate chains. 
 
 > [!NOTE] 
 > Mutual authentication is only available on Standard_v2 and WAF_v2 SKUs. 
 
 ### Certificates supported for mutual authentication
 
-Application Gateway supports the following types of certificates:
-
-- CA (Certificate Authority) certificate: A CA certificate is a digital certificate issued by a certificate authority (CA).
-- Self-signed CA certificates: Client browsers do not trust these certificates and will warn the user that the virtual service's certificate is not part of a trust chain. Self-signed CA certificates are good for testing or in environments where administrators control the clients and can safely bypass the browser's security alerts.  
+Application Gateway supports certificates issued from both public and privately established certificate authorities.
 
-> [!IMPORTANT]
-> Production workloads should never use self-signed CA certificates.
+- CA certificates issued from well-known certificate authorities: Intermediate and root certificates are commonly found in trusted certificate stores and enable trusted connections with little to no additional configuration on the device.
+- CA certificates issued from organization established certificate authorities: These certificates are typically issued privately via your organization and not trusted by other entities. Intermediate and root certificates must be imported in to trusted certificate stores for clients to establish chain trust.
 
-For more information on how to set up mutual authentication, see [configure mutual authentication with Application Gateway](./mutual-authentication-portal.md).
-
-> [!IMPORTANT]
-> Make sure you upload the entire trusted client CA certificate chain to the Application Gateway when using mutual authentication. 
-
-Each SSL profile can support up to five trusted client CA certificate chains. 
+> [!NOTE]
+> When issuing client certificates from well established certificate authorities, consider working with the certificate authority to see if an intermediate certificate can be issued for your organization to prevent inadvertent cross-organizational client certificate authentication.
 
 ## Additional client authentication validation
 
 ### Verify client certificate DN
 
-You have the option to verify the client certificate's immediate issuer and only allow the Application Gateway to trust that issuer. This options is off by default but you can enable this through Portal, PowerShell, or Azure CLI. 
+You have the option to verify the client certificate's immediate issuer and only allow the Application Gateway to trust that issuer. This option is off by default but you can enable this through Portal, PowerShell, or Azure CLI. 
 
 If you choose to enable the Application Gateway to verify the client certificate's immediate issuer, here's how to determine what client certificate issuer DN will be extracted from the certificates uploaded. 
 * **Scenario 1:** Certificate chain includes: root certificate - intermediate certificate - leaf certificate