Skip to content

Commit e87d020

Browse files
authored
Minor edits
1 parent d0624b4 commit e87d020

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

articles/app-service/app-service-web-configure-tls-mutual-auth.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ When you enable client certificate for your app, you should select your choice o
2828
|-|-|
2929
|Required|All requests require a client certificate.|
3030
|Optional|Requests may or may not use a client certificate and clients are prompted for a certificate by default. For example, browser clients will show a prompt to select a certificate for authentication.|
31-
|Optional Interactive User|Requests may or may not use a client certificate and clients are not be prompted for a certificate by default. For example, browser clients won't show a prompt to select a certificate for authentication.|
31+
|Optional Interactive User|Requests may or may not use a client certificate and clients are not prompted for a certificate by default. For example, browser clients won't show a prompt to select a certificate for authentication.|
3232

3333
### [Azure portal](#tab/azureportal)
3434
To set up your app to require client certificates in Azure portal:
@@ -109,12 +109,12 @@ In the following screenshot, any path for your app that starts with `/public` do
109109
![Certificate Exclusion Paths][exclusion-paths]
110110

111111
## Client certificate and TLS renegotiation
112-
App Service requires TLS renegotiation to read a request before knowing whether to prompt for a client certificate. Any of the following settings triggers TLS renegotiation:
113-
1. Use "Optional Interactive User" client certificate mode.
114-
1. Use [client certificate exclusion path](#exclude-paths-from-requiring-authentication).
112+
App Service requires TLS renegotiation to read a request before knowing whether to prompt for a client certificate. Any of the following settings triggers TLS renegotiation:
113+
1. Using "Optional Interactive User" client certificate mode.
114+
1. Using [client certificate exclusion path](#exclude-paths-from-requiring-authentication).
115115

116116
> [!NOTE]
117-
> TLS 1.3 and HTTP 2.0 don't support TLS renegotiation. If you configure your app with these protocols, they won't work with client certificate settings that use TLS renegotiation.
117+
> TLS 1.3 and HTTP 2.0 don't support TLS renegotiation. These protocols will not work if your app is configured with client certificate settings that use TLS renegotiation.
118118
119119
To disable TLS renegotiation and to have the app negotiate client certificates during TLS handshake, you must configure your app with *all* these settings:
120120
1. Set client certificate mode to "Required" or "Optional"
@@ -123,11 +123,11 @@ To disable TLS renegotiation and to have the app negotiate client certificates d
123123
### Uploading large files with TLS renegotiation
124124
Client certificate configurations that use TLS renegotiation cannot support incoming requests with large files greater than 100 kb due to buffer size limitations. In this scenario, any POST or PUT requests over 100 kb will fail with a 403 error. This limit isn't configurable and can't be increased.
125125

126-
These are the only available alternative solutions to address the 100kb limit:
126+
To address the 100 kb limit, consider to these alternative solutions:
127127

128128
1. Update your app's client certificate configuration with _all_ these requirements:
129-
1. Set client certificate mode to either "Required" or "Optional"
130-
1. Remove all client certificate exclusion paths
129+
- Set client certificate mode to either "Required" or "Optional"
130+
- Remove all client certificate exclusion paths
131131
1. Send a HEAD request before the PUT/POST request. The HEAD request will handle the client certificate.
132132
1. Add the header `Expect: 100-Continue` to your request. This will cause the client to wait until the server responds with a `100 Continue` before sending the request body, which bypasses the buffers.
133133

0 commit comments

Comments
 (0)