1

The problem

I have an app service and I want people with specific certificates to be able to call me and then also send the thumbprint of the Certificate to the service. How should I do it in Azure?

More explanation

So lets say there is 10 different systems that should be able to call my service using their own Certificate (signed by). I would want to check them with the ones in my certificate store and if it was one of them put the Thumbprint in the HTTP header and send it to my app service.

What I've found until now:

It seems like a job of a firewall to me, so I've checked the "Application Gateway" seems to be the solution. But I couldn't find where I could set it to add the thumbprint to HTTP headers.

Any ideas?

1 Answer 1

1

Azure Application Gateway is limited to handling certificate in your case. In your case, one of the very common solutions is to use Azure Key Vault certificate to store your certificate. Every time when someone sends a request to your web app, your app will need to call to Azure Key Vault certificate identifier to retrieve and verify thumbprint.

This article can be a good start https://docs.microsoft.com/en-us/rest/api/keyvault/certificates-and-policies

If you use REST API, you can retrieve thumbprint of your certificate using Get Certificate operation (https://docs.microsoft.com/en-us/rest/api/keyvault/getcertificate/getcertificate). The x5t value in the response is the thumbprint info.

Why do I suggest Azure Key Vault? Because it is designed for certificate and cryptographic management. I'm not going to say Azure Key Vault is the best or highly secure but at least it is designed to address your problem for sure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .