Document both TLS legs through Application Gateway

Source facts

Microsoft describes Application Gateway end-to-end encryption as TLS termination at the gateway, followed by routing and re-encryption toward the selected backend. Responses pass through the corresponding process on their return. The guide requires certificates for the gateway and backend servers, making the two connection boundaries explicit. Microsoft Learn.

Applicability

Use this explanation when reviewing a gateway architecture or documenting encryption boundaries. Identify the client-facing listener, backend connection and actual gateway SKU. Consult current SKU-specific certificate and validation requirements before applying any procedural example from the source.

DSE recommendation

DSE recommends drawing the two TLS legs and assigning certificate ownership for each. Ask the application and security teams to agree which identities and trust checks belong at each boundary. Document any requirement that assumes the gateway cannot terminate the client’s TLS session, and resolve that requirement during design review rather than after deployment.

Verification

In an approved test, inspect the certificate presented to the client and separately verify the intended backend TLS configuration. Exercise a representative request and correlate the selected backend with the routing design. Retain sanitized certificate identities and configuration evidence. Successful HTTPS at the public listener alone should not close the backend-encryption verification task.

Official references

Microsoft Learn: Configure end-to-end TLS with Azure Application Gateway.