{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/", "slug": "dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni", "url": "https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/" }, "title": "Check the certificate Application Gateway v2 returns without SNI", "summary": "Review HTTPS rule priority as part of the certificate presented to clients that omit a server name.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:17+00:00", "modified_at": "2026-09-10T00:55:35+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 229, "potentially_affected": "Azure Application Gateway v2 deployments with HTTPS listeners.", "dse_recommendation": "Test the no-SNI connection explicitly and approve the listener certificate selected by rule priority.", "primary_source": { "name": "Enabling end to end TLS on Azure Application Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/ssl-overview", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

When a client connects to Application Gateway v2 without an SNI header, such as by address rather than hostname, the gateway returns the certificate associated with the highest-priority HTTPS routing rule. The highest priority is the lowest numeric priority value.

\n

Microsoft explicitly says that v2 does not use a basic listener’s certificate as a fallback for this situation. The expected certificate therefore needs to be checked against routing-rule priority, not just listener type. Microsoft Learn.

\n

Applicability

\n

Inventory the HTTPS listeners, their certificates, and associated rule priorities. Identify any client or monitoring path that may omit the server name, and keep that case separate from ordinary hostname-based TLS testing.

\n

DSE recommendation

\n

DSE recommends recording the approved no-SNI certificate behavior in the gateway’s listener review. Have the certificate and application owners assess whether the selected certificate is appropriate for that connection. Revisit the decision whenever listener or rule priorities change; do not assume a newly added listener leaves the fallback behavior unchanged.

\n

Verification

\n

From an approved test client, inspect the certificate once with the intended server name and once without SNI. Compare both results with the listener inventory and priority order. Repeat after a representative configuration change, preserving certificate identifiers and handshake evidence. Keep the application response check separate from the certificate-selection result.

\n

Official references

\n

Microsoft Learn: Enabling end to end TLS on Azure Application Gateway. Source retrieved September 9, 2026.

", "content_text": "Source facts\nWhen a client connects to Application Gateway v2 without an SNI header, such as by address rather than hostname, the gateway returns the certificate associated with the highest-priority HTTPS routing rule. The highest priority is the lowest numeric priority value.\nMicrosoft explicitly says that v2 does not use a basic listener’s certificate as a fallback for this situation. The expected certificate therefore needs to be checked against routing-rule priority, not just listener type. Microsoft Learn.\nApplicability\nInventory the HTTPS listeners, their certificates, and associated rule priorities. Identify any client or monitoring path that may omit the server name, and keep that case separate from ordinary hostname-based TLS testing.\nDSE recommendation\nDSE recommends recording the approved no-SNI certificate behavior in the gateway’s listener review. Have the certificate and application owners assess whether the selected certificate is appropriate for that connection. Revisit the decision whenever listener or rule priorities change; do not assume a newly added listener leaves the fallback behavior unchanged.\nVerification\nFrom an approved test client, inspect the certificate once with the intended server name and once without SNI. Compare both results with the listener inventory and priority order. Repeat after a representative configuration change, preserving certificate identifiers and handshake evidence. Keep the application response check separate from the certificate-selection result.\nOfficial references\nMicrosoft Learn: Enabling end to end TLS on Azure Application Gateway. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nWhen a client connects to Application Gateway v2 without an SNI header, such as by address rather than hostname, the gateway returns the certificate associated with the highest-priority HTTPS routing rule. The highest priority is the lowest numeric priority value.\n\nMicrosoft explicitly says that v2 does not use a basic listener’s certificate as a fallback for this situation. The expected certificate therefore needs to be checked against routing-rule priority, not just listener type. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/ssl-overview).\n\n## Applicability\n\nInventory the HTTPS listeners, their certificates, and associated rule priorities. Identify any client or monitoring path that may omit the server name, and keep that case separate from ordinary hostname-based TLS testing.\n\n## DSE recommendation\n\nDSE recommends recording the approved no-SNI certificate behavior in the gateway’s listener review. Have the certificate and application owners assess whether the selected certificate is appropriate for that connection. Revisit the decision whenever listener or rule priorities change; do not assume a newly added listener leaves the fallback behavior unchanged.\n\n## Verification\n\nFrom an approved test client, inspect the certificate once with the intended server name and once without SNI. Compare both results with the listener inventory and priority order. Repeat after a representative configuration change, preserving certificate identifiers and handshake evidence. Keep the application response check separate from the certificate-selection result.\n\n## Official references\n\n[Microsoft Learn: Enabling end to end TLS on Azure Application Gateway](https://learn.microsoft.com/en-us/azure/application-gateway/ssl-overview). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/", "url": "https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check the certificate Application Gateway v2 returns without SNI", "item": "https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/", "url": "https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/", "headline": "Check the certificate Application Gateway v2 returns without SNI", "description": "Review HTTPS rule priority as part of the certificate presented to clients that omit a server name.", "abstract": "Review HTTPS rule priority as part of the certificate presented to clients that omit a server name.", "articleBody": "Source facts\nWhen a client connects to Application Gateway v2 without an SNI header, such as by address rather than hostname, the gateway returns the certificate associated with the highest-priority HTTPS routing rule. The highest priority is the lowest numeric priority value.\nMicrosoft explicitly says that v2 does not use a basic listener’s certificate as a fallback for this situation. The expected certificate therefore needs to be checked against routing-rule priority, not just listener type. Microsoft Learn.\nApplicability\nInventory the HTTPS listeners, their certificates, and associated rule priorities. Identify any client or monitoring path that may omit the server name, and keep that case separate from ordinary hostname-based TLS testing.\nDSE recommendation\nDSE recommends recording the approved no-SNI certificate behavior in the gateway’s listener review. Have the certificate and application owners assess whether the selected certificate is appropriate for that connection. Revisit the decision whenever listener or rule priorities change; do not assume a newly added listener leaves the fallback behavior unchanged.\nVerification\nFrom an approved test client, inspect the certificate once with the intended server name and once without SNI. Compare both results with the listener inventory and priority order. Repeat after a representative configuration change, preserving certificate identifiers and handshake evidence. Keep the application response check separate from the certificate-selection result.\nOfficial references\nMicrosoft Learn: Enabling end to end TLS on Azure Application Gateway. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:29:17+00:00", "dateModified": "2026-09-10T00:55:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check the certificate Application Gateway v2 returns without SNI" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 229, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Enabling end to end TLS on Azure Application Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/ssl-overview" } } ] } }