You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/app-service/app-service-web-configure-tls-mutual-auth.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -28,7 +28,7 @@ When you enable client certificate for your app, you should select your choice o
28
28
|-|-|
29
29
|Required|All requests require a client certificate.|
30
30
|Optional|Requests may or may not use a client certificate and clients are prompted for a certificate by default. For example, browser clients will show a prompt to select a certificate for authentication.|
31
-
|Optional Interactive User|Requests may or may not use a client certificate and clients are not be prompted for a certificate by default. For example, browser clients won't show a prompt to select a certificate for authentication.|
31
+
|Optional Interactive User|Requests may or may not use a client certificate and clients are not prompted for a certificate by default. For example, browser clients won't show a prompt to select a certificate for authentication.|
32
32
33
33
### [Azure portal](#tab/azureportal)
34
34
To set up your app to require client certificates in Azure portal:
@@ -109,12 +109,12 @@ In the following screenshot, any path for your app that starts with `/public` do
109
109
![Certificate Exclusion Paths][exclusion-paths]
110
110
111
111
## Client certificate and TLS renegotiation
112
-
App Service requires TLS renegotiation to read a request before knowing whether to prompt for a client certificate. Any of the following settings triggers TLS renegotiation:
App Service requires TLS renegotiation to read a request before knowing whether to prompt for a client certificate. Any of the following settings triggers TLS renegotiation:
> TLS 1.3 and HTTP 2.0 don't support TLS renegotiation. If you configure your app with these protocols, they won't work with client certificate settings that use TLS renegotiation.
117
+
> TLS 1.3 and HTTP 2.0 don't support TLS renegotiation. These protocols will not work if your app is configured with client certificate settings that use TLS renegotiation.
118
118
119
119
To disable TLS renegotiation and to have the app negotiate client certificates during TLS handshake, you must configure your app with *all* these settings:
120
120
1. Set client certificate mode to "Required" or "Optional"
@@ -123,11 +123,11 @@ To disable TLS renegotiation and to have the app negotiate client certificates d
123
123
### Uploading large files with TLS renegotiation
124
124
Client certificate configurations that use TLS renegotiation cannot support incoming requests with large files greater than 100 kb due to buffer size limitations. In this scenario, any POST or PUT requests over 100 kb will fail with a 403 error. This limit isn't configurable and can't be increased.
125
125
126
-
These are the only available alternative solutions to address the 100kb limit:
126
+
To address the 100 kb limit, consider to these alternative solutions:
127
127
128
128
1. Update your app's client certificate configuration with _all_ these requirements:
129
-
1. Set client certificate mode to either "Required" or "Optional"
130
-
1. Remove all client certificate exclusion paths
129
+
- Set client certificate mode to either "Required" or "Optional"
130
+
- Remove all client certificate exclusion paths
131
131
1. Send a HEAD request before the PUT/POST request. The HEAD request will handle the client certificate.
132
132
1. Add the header `Expect: 100-Continue` to your request. This will cause the client to wait until the server responds with a `100 Continue` before sending the request body, which bypasses the buffers.
0 commit comments