# Document both TLS legs through Application Gateway

> Identify where TLS terminates and where the backend connection begins.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:04+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Identify where TLS terminates and where the backend connection begins.

## Potentially affected

Use this explanation when reviewing a gateway architecture or documenting encryption boundaries. Identify the client-facing listener, backend connection and actual gateway SKU. Consult current SKU-specific certificate and validation requirements before applying any procedural example from the source.

## DSE recommendation

DSE recommends drawing the two TLS legs and assigning certificate ownership for each.

## Article

## Source facts

Microsoft describes Application Gateway end-to-end encryption as TLS termination at the gateway, followed by routing and re-encryption toward the selected backend. Responses pass through the corresponding process on their return. The guide requires certificates for the gateway and backend servers, making the two connection boundaries explicit. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-end-to-end-ssl-powershell).

## Applicability

Use this explanation when reviewing a gateway architecture or documenting encryption boundaries. Identify the client-facing listener, backend connection and actual gateway SKU. Consult current SKU-specific certificate and validation requirements before applying any procedural example from the source.

## DSE recommendation

DSE recommends drawing the two TLS legs and assigning certificate ownership for each. Ask the application and security teams to agree which identities and trust checks belong at each boundary. Document any requirement that assumes the gateway cannot terminate the client’s TLS session, and resolve that requirement during design review rather than after deployment.

## Verification

In an approved test, inspect the certificate presented to the client and separately verify the intended backend TLS configuration. Exercise a representative request and correlate the selected backend with the routing design. Retain sanitized certificate identities and configuration evidence. Successful HTTPS at the public listener alone should not close the backend-encryption verification task.

## Official references

[Microsoft Learn: Configure end-to-end TLS with Azure Application Gateway](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-end-to-end-ssl-powershell).

## Primary reference

- Name: Configure end-to-end TLS with Azure Application Gateway | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-end-to-end-ssl-powershell
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Document both TLS legs through Application Gateway,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-176-document-both-tls-legs-through-application-gateway/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.