Merge pull request #189014 from mscatyao/patch-1

mtls GA docs

Author: PRMerger13

articles/application-gateway/application-gateway-configure-listener-specific-ssl-policy.md

@@ -5,11 +5,11 @@ services: application-gateway
 author: mscatyao
 ms.service: application-gateway
 ms.topic: how-to
-ms.date: 03/30/2021
+ms.date: 02/18/2022
 ms.author: caya
 ---
 
-# Configure listener-specific SSL policies on Application Gateway through portal (Preview)
+# Configure listener-specific SSL policies on Application Gateway through portal
 
 This article describes how to use the Azure portal to configure listener-specific SSL policies on your Application Gateway. Listener-specific SSL policies allow you to configure specific listeners to use different SSL policies from each other. You'll still be able to set a default SSL policy that all listeners will use unless overwritten by the listener-specific SSL policy. 
 
@@ -26,14 +26,14 @@ First create a new Application Gateway as you would usually through the portal -
 
 ## Set up a listener-specific SSL policy
 
-To set up a listener-specific SSL policy, you'll need to first go to the **SSL settings (Preview)** tab in the Portal and create a new SSL profile. When you create an SSL profile, you'll see two tabs: **Client Authentication** and **SSL Policy**. The **SSL Policy** tab is to configure a listener-specific SSL policy. The **Client Authentication** tab is where to upload a client certificate(s) for mutual authentication - for more information, check out [Configuring a mutual authentication](./mutual-authentication-portal.md).
+To set up a listener-specific SSL policy, you'll need to first go to the **SSL settings** tab in the Portal and create a new SSL profile. When you create an SSL profile, you'll see two tabs: **Client Authentication** and **SSL Policy**. The **SSL Policy** tab is to configure a listener-specific SSL policy. The **Client Authentication** tab is where to upload a client certificate(s) for mutual authentication - for more information, check out [Configuring a mutual authentication](./mutual-authentication-portal.md).
 
 > [!NOTE]
 > We recommend using TLS 1.2 as TLS 1.2 will be mandated in the future. 
 
 1. Search for **Application Gateway** in portal, select **Application gateways**, and click on your existing Application Gateway.
 
-2. Select **SSL settings (Preview)** from the left-side menu.
+2. Select **SSL settings** from the left-side menu.
 
 3. Click on the plus sign next to **SSL Profiles** at the top to create a new SSL profile.
 
@@ -72,7 +72,10 @@ Now that we've created an SSL profile with a listener-specific SSL policy, we ne
 
     ![Associate SSL profile to new listener](./media/mutual-authentication-portal/mutual-authentication-listener-portal.png)        
 
+### Limitations
+There is a limitation right now on Application Gateway where different listeners using the same port cannot have the same custom SSL policy configured. To ensure that the custom protocols configured as part of the custom SSL policy are applied to a listener, make sure that different listeners are running on different ports or configure the same custom SSL policy with the same custom protocols across all listeners running on the same port. 
+
 ## Next steps
 
 > [!div class="nextstepaction"]
-> [Manage web traffic with an application gateway using the Azure CLI](./tutorial-manage-web-traffic-cli.md)
+> [Manage web traffic with an application gateway using the Azure CLI](./tutorial-manage-web-traffic-cli.md)

articles/application-gateway/mutual-authentication-overview.md

@@ -41,6 +41,8 @@ For more information on how to set up mutual authentication, see [configure mutu
 > [!IMPORTANT]
 > Make sure you upload the entire trusted client CA certificate chain to the Application Gateway when using mutual authentication. 
 
+Each SSL profile can support up to 5 trusted client CA certificate chains. 
+
 ## Additional client authentication validation
 
 ### Verify client certificate DN
@@ -68,6 +70,10 @@ For more information on how to extract trusted client CA certificate chains, see
 
 With mutual authentication, there are additional server variables that you can use to pass information about the client certificate to the backend servers behind the Application Gateway. For more information about which server variables are available and how to use them, check out [server variables](./rewrite-http-headers-url.md#mutual-authentication-server-variables-preview).
 
+## Certificate Revocation
+
+Client certificate revocation with OCSP (Online Certificate Status Protocol) will be supported shortly. 
+
 ## Next steps
 
 After learning about mutual authentication, go to [Configure Application Gateway with mutual authentication in PowerShell](./mutual-authentication-powershell.md) to create an Application Gateway using mutual authentication. 

articles/application-gateway/mutual-authentication-portal.md

@@ -5,11 +5,11 @@ services: application-gateway
 author: mscatyao
 ms.service: application-gateway
 ms.topic: how-to
-ms.date: 04/02/2021
+ms.date: 02/18/2022
 ms.author: caya
 ---
 
-# Configure mutual authentication with Application Gateway through portal (Preview)
+# Configure mutual authentication with Application Gateway through portal 
 
 This article describes how to use the Azure portal to configure mutual authentication on your Application Gateway. Mutual authentication means Application Gateway authenticates the client sending the request using the client certificate you upload onto the Application Gateway. 
 
@@ -27,14 +27,14 @@ First create a new Application Gateway as you would usually through the portal -
 
 ## Configure mutual authentication 
 
-To configure an existing Application Gateway with mutual authentication, you'll need to first go to the **SSL settings (Preview)** tab in the Portal and create a new SSL profile. When you create an SSL profile, you'll see two tabs: **Client Authentication** and **SSL Policy**. The **Client Authentication** tab is where you'll upload your client certificate(s). The **SSL Policy** tab is to configure a listener specific SSL policy - for more information, check out [Configuring a listener specific SSL policy](./application-gateway-configure-listener-specific-ssl-policy.md).
+To configure an existing Application Gateway with mutual authentication, you'll need to first go to the **SSL settings** tab in the Portal and create a new SSL profile. When you create an SSL profile, you'll see two tabs: **Client Authentication** and **SSL Policy**. The **Client Authentication** tab is where you'll upload your client certificate(s). The **SSL Policy** tab is to configure a listener specific SSL policy - for more information, check out [Configuring a listener specific SSL policy](./application-gateway-configure-listener-specific-ssl-policy.md).
 
 > [!IMPORTANT]
 > Please ensure that you upload the entire client CA certificate chain in one file, and only one chain per file.
 
 1. Search for **Application Gateway** in portal, select **Application gateways**, and click on your existing Application Gateway.
 
-2. Select **SSL settings (Preview)** from the left-side menu.
+2. Select **SSL settings** from the left-side menu.
 
 3. Click on the plus sign next to **SSL Profiles** at the top to create a new SSL profile.
 
@@ -82,7 +82,7 @@ Now that we've created an SSL profile with mutual authentication configured, we
 
 In the case that your client CA certificate has expired, you can update the certificate on your gateway through the following steps: 
 
-1. Navigate to your Application Gateway and go to the **SSL settings (Preview)** tab in the left-hand menu. 
+1. Navigate to your Application Gateway and go to the **SSL settings** tab in the left-hand menu. 
 
 1. Select the existing SSL profile(s) with the expired client certificate. 
 
@@ -94,4 +94,4 @@ In the case that your client CA certificate has expired, you can update the cert
 
 ## Next steps
 
-- [Manage web traffic with an application gateway using the Azure CLI](./tutorial-manage-web-traffic-cli.md)
+- [Manage web traffic with an application gateway using the Azure CLI](./tutorial-manage-web-traffic-cli.md)

articles/application-gateway/mutual-authentication-powershell.md

@@ -5,12 +5,12 @@ services: application-gateway
 author: mscatyao
 ms.service: application-gateway
 ms.topic: how-to
-ms.date: 04/02/2021
+ms.date: 02/18/2022
 ms.author: caya 
 ms.custom: devx-track-azurepowershell
 ---
 
-# Configure mutual authentication with Application Gateway through PowerShell (Preview)
+# Configure mutual authentication with Application Gateway through PowerShell
 This article describes how to use the PowerShell to configure mutual authentication on your Application Gateway. Mutual authentication means Application Gateway authenticates the client sending the request using the client certificate you upload onto the Application Gateway. 
 
 If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.

articles/application-gateway/mutual-authentication-troubleshooting.md

@@ -5,7 +5,7 @@ services: application-gateway
 author: mscatyao
 ms.service: application-gateway
 ms.topic: troubleshooting
-ms.date: 04/02/2021
+ms.date: 02/18/2022
 ms.author: caya
 ---
 
@@ -22,7 +22,7 @@ After configuring mutual authentication on an Application Gateway, there can be
 * Uploaded a certificate chain that only contained a leaf certificate without a CA certificate 
 * Validation errors due to issuer DN mismatch  
 
-We'll go through different scenarios that you might run into and how to troubleshoot those scenarios. We'll then address error codes and explain likely causes for certain error codes you might be seeing with mutual authentication. 
+We'll go through different scenarios that you might run into and how to troubleshoot those scenarios. We'll then address error codes and explain likely causes for certain error codes you might be seeing with mutual authentication. All client certificate authentication failures should result in an HTTP 400 error code. 
 
 ## Scenario troubleshooting - configuration problems
 There are a few scenarios that you might be facing when trying to configure mutual authentication. We'll walk through how to troubleshoot some of the most common pitfalls.