# Check the certificate Application Gateway v2 returns without SNI

> Review HTTPS rule priority as part of the certificate presented to clients that omit a server name.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:29:17+00:00
- Modified: 2026-09-10T00:55:35+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Review HTTPS rule priority as part of the certificate presented to clients that omit a server name.

## Potentially affected

Azure Application Gateway v2 deployments with HTTPS listeners.

## DSE recommendation

Test the no-SNI connection explicitly and approve the listener certificate selected by rule priority.

## Article

## Source facts

When a client connects to Application Gateway v2 without an SNI header, such as by address rather than hostname, the gateway returns the certificate associated with the highest-priority HTTPS routing rule. The highest priority is the lowest numeric priority value.

Microsoft explicitly says that v2 does not use a basic listener’s certificate as a fallback for this situation. The expected certificate therefore needs to be checked against routing-rule priority, not just listener type. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/ssl-overview).

## Applicability

Inventory the HTTPS listeners, their certificates, and associated rule priorities. Identify any client or monitoring path that may omit the server name, and keep that case separate from ordinary hostname-based TLS testing.

## DSE recommendation

DSE recommends recording the approved no-SNI certificate behavior in the gateway’s listener review. Have the certificate and application owners assess whether the selected certificate is appropriate for that connection. Revisit the decision whenever listener or rule priorities change; do not assume a newly added listener leaves the fallback behavior unchanged.

## Verification

From an approved test client, inspect the certificate once with the intended server name and once without SNI. Compare both results with the listener inventory and priority order. Repeat after a representative configuration change, preserving certificate identifiers and handshake evidence. Keep the application response check separate from the certificate-selection result.

## Official references

[Microsoft Learn: Enabling end to end TLS on Azure Application Gateway](https://learn.microsoft.com/en-us/azure/application-gateway/ssl-overview). Source retrieved September 9, 2026.

## Primary reference

- Name: Enabling end to end TLS on Azure Application Gateway | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/application-gateway/ssl-overview
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check the certificate Application Gateway v2 returns without SNI,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-159-check-the-certificate-application-gateway-v2-returns-without-sni/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.