Public Preview: Azure Front Door mutual TLS
Share
Services
Mutual TLS, also known as client certificate authentication, enables Azure Front Door to authenticate clients using X.509 certificates before requests reach an application. It helps protect sensitive applications and APIs across business-to-business, Internet of Things, financial services, VPN, and enterprise network scenarios.
Customers can choose from four client certificate validation modes:
* Require and validate: A client certificate is mandatory. Azure Front Door validates the certificate at the edge and forwards it to the origin in the X-Azure-ClientCertificate request header.
* Require without validation: A client certificate is mandatory, but Azure Front Door does not validate it. The certificate is forwarded in the X-Azure-ClientCertificate header for validation by the origin.
* Validate when presented: A client certificate is optional. When a certificate is presented, Azure Front Door validates it and forwards it to the origin. Requests without a certificate are allowed to continue.
* Pass through to the origin: A client certificate is optional. Azure Front Door does not validate it but forwards it to the origin when presented, allowing the origin to perform validation.
Azure Front Door supports client certificates issued by public and private certificate authorities. Customers upload the trusted certificate authority chain to Azure Key Vault and associate it with a Front Door custom domain.
[Learn more](https://learn.microsoft.com/en-us/azure/frontdoor/mutual-tls).
What else is happening at Microsoft Azure?
Read update
Services
Share
Read update
Services
Share
Generally Available: Azure Virtual Network Manager IPAM in additional Azure regions
September 3rd, 2026
Services
Share
Public Preview: Azure Front Door profile and route level WAF policies
September 2nd, 2026
Services
Share
Generally Available: Azure Firewall auto-learn SNAT routes
September 1st, 2026
Services
Share