You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/application-gateway/end-to-end-ssl-portal.md
+32-31Lines changed: 32 additions & 31 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ ms.custom: mvc
11
11
---
12
12
# Configure end-to-end SSL by using Application Gateway with the portal
13
13
14
-
This article shows you how to use the Azure portal to configure end-to-end SSL encryption with an application gateway v1 SKU.
14
+
This article describes how to use the Azure portal to configure end-to-end Secure Sockets Layer (SSL) encryption through Azure Application Gateway v1 SKU.
@@ -20,94 +20,95 @@ If you don't have an Azure subscription, create a [free account](https://azure.m
20
20
21
21
## Before you begin
22
22
23
-
To configure end-to-end SSL with an Application Gateway, a certificate is required for the gateway and certificates are required for the back-end servers. The gateway certificate is used to derive a symmetric key as per SSL protocol specification. The symmetric key is then used to encrypt and decrypt the traffic sent to the gateway. For end-to-end SSL encryption, the right back-end servers must be allowed in the application gateway. To do this, upload the public certificate of the back-end servers, also known as Authentication Certificates (v1) or Trusted Root Certificates (v2), to the Application Gateway. Adding the certificate ensures that the Application Gateway only communicates with known back-end instances. This further secures the end-to-end communication.
23
+
To configure end-to-end SSL with an application gateway, a certificate is required for the gateway. Certificates are also required for the back-end servers. The gateway certificate is used to derive a symmetric key in compliance with the SSL protocol specification. The symmetric key is then used to encrypt and decrypt the traffic sent to the gateway. For end-to-end SSL encryption, the right back-end servers must be allowed in the application gateway. To allow this access, upload the public certificate of the back-end servers, also known as Authentication Certificates (v1) or Trusted Root Certificates (v2), to the application gateway. Adding the certificate ensures that the application gateway communicates only with known back-end instances. This configuration further secures end-to-end communication.
24
24
25
25
To learn more, see [SSL termination and end-to-end SSL](https://docs.microsoft.com/azure/application-gateway/ssl-overview).
26
26
27
27
## Create a new application gateway with end-to-end SSL
28
28
29
-
To create a new application gateway with end-to-end SSL encryption, you'll need to first enable SSL termination while creating a new application gateway. This will enable SSL encryption for the communication between the client and application gateway. Then, you'll need to whitelist certificates for backend servers in the HTTP settings to enable SSL encryption for the communication between the application gateway and backend servers, accomplishing end-to-end SSL encryption.
29
+
To create a new application gateway with end-to-end SSL encryption, you'll need to first enable SSL termination while creating a new application gateway. This action enables SSL encryption for communication between the client and application gateway. Then, you'll need to put on the Safe Recipients list the certificates for the back-end servers in the HTTP settings. This configuration enables SSL encryption for communication between the application gateway and the back-end servers. That accomplishes end-to-end SSL encryption.
30
30
31
31
### Enable SSL termination while creating a new application gateway
32
32
33
-
Refer to this article to understand how to[enable SSL termination while creating a new application gateway](https://docs.microsoft.com/azure/application-gateway/create-ssl-portal).
33
+
To learn more, see[enable SSL termination while creating a new application gateway](https://docs.microsoft.com/azure/application-gateway/create-ssl-portal).
34
34
35
35
### Add authentication/root certificate of back-end servers
36
36
37
37
1. Select **All resources**, and then select **myAppGateway**.
38
38
39
-
2. Select **HTTP settings** from the left menu. Azure automatically created a default HTTP setting, **appGatewayBackendHttpSettings**, when you created the application gateway.
39
+
2. Select **HTTP settings** from the left-side menu. Azure automatically created a default HTTP setting, **appGatewayBackendHttpSettings**, when you created the application gateway.
40
40
41
41
3. Select **appGatewayBackendHttpSettings**.
42
42
43
-
4. Under **Protocol**, select **HTTPS**. A pane for **Backend authentication certificates or Trusted root certificates**will appear.
43
+
4. Under **Protocol**, select **HTTPS**. A pane for **Backend authentication certificates or Trusted root certificates**appears.
44
44
45
-
5.Choose**Create new**.
45
+
5.Select**Create new**.
46
46
47
-
6.Enter a suitable **Name**.
47
+
6.In the **Name** field, enter a suitable name.
48
48
49
-
7. Select the certificate file using the **Upload CER certificate** box.
49
+
7. Select the certificate file in the **Upload CER certificate** box.
50
50
51
-
For Standard and WAF (v1) Application Gateways, you should upload the public key of your backend server certificate in .cer format.
51
+
For Standard and WAF (v1) application gateways, you should upload the public key of your back-end server certificate in .cer format.
For Standard_v2 and WAF_v2 Application Gateways, you should upload the **root certificate** of the backend server certificate in .cer format. If the backend certificate is issued by a well-known CA, you can check the "Use Well Known CA certificate" box and there is no need to upload a certificate.
55
+
For Standard_v2 and WAF_v2 application gateways, you should upload the root certificate of the back-end server certificate in .cer format. If the back-end certificate is issued by a well-known certificate authority (CA), you can select the **Use Well Known CA Certificate** check box, and then you don't have to upload a certificate.
## Enable end-to-end SSL for existing application gateway
64
64
65
-
To configure an existing application gateway with end-to-end SSL encryption, you'll need to first enable SSL termination in the listener. This will enable SSL encryption for the communication between the client and application gateway. Then, you'll need to whitelist certificates for backend servers in the HTTP settings to enable SSL encryption for the communication between the application gateway and backend servers, accomplishing end-to-end SSL encryption.
65
+
To configure an existing application gateway with end-to-end SSL encryption, you must first enable SSL termination in the listener. This action enables SSL encryption for communication between the client and the application gateway. Then, put those certificates for back-end servers in the HTTP settings on the Safe Recipients list. This configuration enables SSL encryption for communication between the application gateway and the back-end servers. That accomplishes end-to-end SSL encryption.
66
66
67
-
You'll need to use a listener with HTTPS protocol and certificate for enabling SSL termination. So, you can either choose to use an existing listener with HTTPS protocol and certificate, or create a new listener. In case you choose the former, you can ignore the below mentioned steps to **Enable SSL termination in existing application gateway**and directly move to **Add authentication/trusted root certificates for back-end servers** section. If you choose the latter, use these steps.
67
+
You'll need to use a listener with the HTTPS protocol and a certificate for enabling SSL termination. You can either use an existing listener that meets those conditions or create a new listener. If you choose the former option, you can ignore the following "Enable SSL termination in existing application gateway" section and move directly to the "Add authentication/trusted root certificates for backend servers" section.
68
68
69
+
If you choose the latter option, apply the steps in the following procedure.
69
70
### Enable SSL termination in existing application gateway
70
71
71
72
1. Select **All resources**, and then select **myAppGateway**.
72
73
73
-
2. Select **Listeners** from the left menu.
74
+
2. Select **Listeners** from the left-side menu.
74
75
75
-
3.Choose between**Basic**and**Multi-site** listener as per your requirement.
76
+
3.Select either**Basic**or**Multi-site** listener depending on your requirements.
76
77
77
-
4. Under **Protocol**, select **HTTPS**. A pane for **Certificate**will appear.
78
+
4. Under **Protocol**, select **HTTPS**. A pane for **Certificate**appears.
78
79
79
-
5. Upload the PFX certificate that you intend to use for SSL termination between the client and application gateway.
80
+
5. Upload the PFX certificate you intend to use for SSL termination between the client and the application gateway.
80
81
81
82
> [!NOTE]
82
-
> For testing purposes, you can use a self-signed certificate. but not advised for production workloads as they are harder to manage and not completely secure. Learn how to[create a self-signed certificate](https://docs.microsoft.com/azure/application-gateway/create-ssl-portal#create-a-self-signed-certificate).
83
+
> For testing purposes, you can use a self-signed certificate. However, this is not advised for production workloads, because they're harder to manage and aren't completely secure. For more info, see[create a self-signed certificate](https://docs.microsoft.com/azure/application-gateway/create-ssl-portal#create-a-self-signed-certificate).
83
84
84
-
6. Add other required settings for the **Listener** as per your requirement.
85
+
6. Add other required settings for the **Listener**, depending on your requirements.
85
86
86
87
7. Select **OK** to save.
87
88
88
89
### Add authentication/trusted root certificates of back-end servers
89
90
90
91
1. Select **All resources**, and then select **myAppGateway**.
91
92
92
-
2. Select **HTTP settings** from the left menu. You can either whitelist certificates in an existing backend HTTP setting or create a new HTTP setting. In the below step, we will whitelist certificate for the default HTTP setting, **appGatewayBackendHttpSettings**.
93
+
2. Select **HTTP settings** from the left-side menu. You can either put certificates in an existing back-end HTTP setting on the Safe Recipients list or create a new HTTP setting. (In the next step, the certificate for the default HTTP setting, **appGatewayBackendHttpSettings**, is added to the Safe Recipients list.)
93
94
94
95
3. Select **appGatewayBackendHttpSettings**.
95
96
96
-
4. Under **Protocol**, select **HTTPS**. A pane for **Backend authentication certificates or Trusted root certificates**will appear.
97
+
4. Under **Protocol**, select **HTTPS**. A pane for **Backend authentication certificates or Trusted root certificates**appears.
97
98
98
-
5.Choose**Create new**.
99
+
5.Select**Create new**.
99
100
100
-
6.Enter suitable**Name**.
101
+
6.In the**Name** field, enter a suitable name.
101
102
102
-
7. Select the certificate file using the **Upload CER certificate** box.
103
+
7. Select the certificate file in the **Upload CER certificate** box.
103
104
104
-
For Standard and WAF (v1) Application Gateways, you should upload the public key of your backend server certificate in .cer format.
105
+
For Standard and WAF (v1) application gateways, you should upload the public key of your back-end server certificate in .cer format.
For Standard_v2 and WAF_v2 Application Gateways, you should upload the **root certificate** of the backend server certificate in .cer format. If the backend certificate is issued by a well-known CA, you can check the "Use Well Known CA certificate" box and there is no need to upload a certificate.
109
+
For Standard_v2 and WAF_v2 application gateways, you should upload the root certificate of the back-end server certificate in .cer format. If the back-end certificate is issued by a well-known CA, you can select the **Use Well Known CA Certificate** check box, and then you don't have to upload a certificate.
0 commit comments