{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-176-document-both-tls-legs-through-application-gateway/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/",
        "slug": "dse-20260917-176-document-both-tls-legs-through-application-gateway",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-176-document-both-tls-legs-through-application-gateway/"
        },
        "title": "Document both TLS legs through Application Gateway",
        "summary": "Identify where TLS terminates and where the backend connection begins.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:32:04+00:00",
        "modified_at": "2026-09-17T16:46:29+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 209,
        "potentially_affected": "Use this explanation when reviewing a gateway architecture or documenting encryption boundaries. Identify the client-facing listener, backend connection and actual gateway SKU. Consult current SKU-specific certificate and validation requirements before applying any procedural example from the source.",
        "dse_recommendation": "DSE recommends drawing the two TLS legs and assigning certificate ownership for each.",
        "primary_source": {
            "name": "Configure end-to-end TLS with Azure Application Gateway | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-end-to-end-ssl-powershell",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft describes Application Gateway end-to-end encryption as TLS termination at the gateway, followed by routing and re-encryption toward the selected backend. Responses pass through the corresponding process on their return. The guide requires certificates for the gateway and backend servers, making the two connection boundaries explicit. <a href=\"https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-end-to-end-ssl-powershell\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Use this explanation when reviewing a gateway architecture or documenting encryption boundaries. Identify the client-facing listener, backend connection and actual gateway SKU. Consult current SKU-specific certificate and validation requirements before applying any procedural example from the source.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends drawing the two TLS legs and assigning certificate ownership for each. Ask the application and security teams to agree which identities and trust checks belong at each boundary. Document any requirement that assumes the gateway cannot terminate the client&#8217;s TLS session, and resolve that requirement during design review rather than after deployment.</p>\n<h2>Verification</h2>\n<p>In an approved test, inspect the certificate presented to the client and separately verify the intended backend TLS configuration. Exercise a representative request and correlate the selected backend with the routing design. Retain sanitized certificate identities and configuration evidence. Successful HTTPS at the public listener alone should not close the backend-encryption verification task.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-end-to-end-ssl-powershell\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Configure end-to-end TLS with Azure Application Gateway</a>.</p>",
        "content_text": "Source facts\nMicrosoft describes Application Gateway end-to-end encryption as TLS termination at the gateway, followed by routing and re-encryption toward the selected backend. Responses pass through the corresponding process on their return. The guide requires certificates for the gateway and backend servers, making the two connection boundaries explicit. Microsoft Learn.\nApplicability\nUse this explanation when reviewing a gateway architecture or documenting encryption boundaries. Identify the client-facing listener, backend connection and actual gateway SKU. Consult current SKU-specific certificate and validation requirements before applying any procedural example from the source.\nDSE recommendation\nDSE recommends drawing the two TLS legs and assigning certificate ownership for each. Ask the application and security teams to agree which identities and trust checks belong at each boundary. Document any requirement that assumes the gateway cannot terminate the client’s TLS session, and resolve that requirement during design review rather than after deployment.\nVerification\nIn an approved test, inspect the certificate presented to the client and separately verify the intended backend TLS configuration. Exercise a representative request and correlate the selected backend with the routing design. Retain sanitized certificate identities and configuration evidence. Successful HTTPS at the public listener alone should not close the backend-encryption verification task.\nOfficial references\nMicrosoft Learn: Configure end-to-end TLS with Azure Application Gateway.",
        "content_markdown": "## Source facts\n\nMicrosoft describes Application Gateway end-to-end encryption as TLS termination at the gateway, followed by routing and re-encryption toward the selected backend. Responses pass through the corresponding process on their return. The guide requires certificates for the gateway and backend servers, making the two connection boundaries explicit. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-end-to-end-ssl-powershell).\n\n## Applicability\n\nUse this explanation when reviewing a gateway architecture or documenting encryption boundaries. Identify the client-facing listener, backend connection and actual gateway SKU. Consult current SKU-specific certificate and validation requirements before applying any procedural example from the source.\n\n## DSE recommendation\n\nDSE recommends drawing the two TLS legs and assigning certificate ownership for each. Ask the application and security teams to agree which identities and trust checks belong at each boundary. Document any requirement that assumes the gateway cannot terminate the client’s TLS session, and resolve that requirement during design review rather than after deployment.\n\n## Verification\n\nIn an approved test, inspect the certificate presented to the client and separately verify the intended backend TLS configuration. Exercise a representative request and correlate the selected backend with the routing design. Retain sanitized certificate identities and configuration evidence. Successful HTTPS at the public listener alone should not close the backend-encryption verification task.\n\n## Official references\n\n[Microsoft Learn: Configure end-to-end TLS with Azure Application Gateway](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-end-to-end-ssl-powershell)."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Document both TLS legs through Application Gateway",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/",
                "headline": "Document both TLS legs through Application Gateway",
                "description": "Identify where TLS terminates and where the backend connection begins.",
                "abstract": "Identify where TLS terminates and where the backend connection begins.",
                "articleBody": "Source facts\nMicrosoft describes Application Gateway end-to-end encryption as TLS termination at the gateway, followed by routing and re-encryption toward the selected backend. Responses pass through the corresponding process on their return. The guide requires certificates for the gateway and backend servers, making the two connection boundaries explicit. Microsoft Learn.\nApplicability\nUse this explanation when reviewing a gateway architecture or documenting encryption boundaries. Identify the client-facing listener, backend connection and actual gateway SKU. Consult current SKU-specific certificate and validation requirements before applying any procedural example from the source.\nDSE recommendation\nDSE recommends drawing the two TLS legs and assigning certificate ownership for each. Ask the application and security teams to agree which identities and trust checks belong at each boundary. Document any requirement that assumes the gateway cannot terminate the client’s TLS session, and resolve that requirement during design review rather than after deployment.\nVerification\nIn an approved test, inspect the certificate presented to the client and separately verify the intended backend TLS configuration. Exercise a representative request and correlate the selected backend with the routing design. Retain sanitized certificate identities and configuration evidence. Successful HTTPS at the public listener alone should not close the backend-encryption verification task.\nOfficial references\nMicrosoft Learn: Configure end-to-end TLS with Azure Application Gateway.",
                "datePublished": "2026-09-17T16:32:04+00:00",
                "dateModified": "2026-09-17T16:46:29+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Document both TLS legs through Application Gateway"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 209,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Configure end-to-end TLS with Azure Application Gateway | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-end-to-end-ssl-powershell"
                }
            }
        ]
    }
}