Azure 应用服务中的证书排除路径

Question

I've an Azure App Service where one single page requires a client certificate (ex: help/tools/checker ).

In the configuration of App Service, there isn't an option like "inclusion paths", so, I'm including all rest of my paths in the "exclusion paths" list, but, my problem here is that the homepage also is requiring the client certificate. Is there some trick to avoid this behavior?

Answer 1

you can exclude from requiring the client certificate authentication by following the steps below:-

When you enable mutual auth for your application, all paths under the root of your app require a client certificate for access. To remove this requirement for certain paths, define exclusion paths as part of your application configuration.

-->From the left navigation of your app's management page, select Configuration > General Settings.

-->Next to Client exclusion paths, click the edit icon.

-->Click New path, specify a path, or a list of paths separated by , or ;, and click OK.

-->Click Save at the top of the page.

In the following screenshot, any path for your app that starts with /public does not request a client certificate. Path matching is case-insensitive.

For more information related to TLS/Client Certificate Authentication you can go through this document click here .

Answer 2

As you've discovered, any path that starts with one of the entries under Certificate Exclusion Paths will be excluded from requiring a client certificate. Therefore if one of the exclusion paths is "/", then all paths will be excluded (since all paths start with "/").

One workaround would be to:

1. Use Client Certificate Mode "Allow" (instead of "Require"). This configures the App Service to request a client certificate from the client, but still allow the connection if no client certificate is provided.
2. In your application code, check for the client certificate in the X-ARR-ClientCert header for only the paths you want. By writing the code yourself to check for client certificates, you have complete flexibility in the paths that require and don't require client certificates.