Azure Application Gateway for Containers mTLS header forwarding possible?

Question

Azure Application Gateway for Containers mTLS header forwarding possible?

Aleksandar 0

We are migrating to Azure Kubernetes Service with Azure Application Gateway for Containers and we have the following use case:

Some of our clients use mTLS when calling our APIs, while others do not.

What we want to achieve is to have TLS termination at the Gateway level, and after that the certificate thumbprint/fingerprint to be passed downstream to the backend target(s) as a Request Header (because this is needed for a logic that the service has).

Is that achievable?

Based on the documentation specific here - I can't find anything that explains that so I would like to see if someone has any recommendations on if and how can this be achieved.

https://gateway-api.sigs.k8s.io/guides/user-guides/tls/

https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/how-to-frontend-mtls-gateway-api?tabs=alb-managed

Thanks a lot in advance

0 comments

1 answer

Your answer

Answer 1

Christos Panagiotidis 3,546

With the currently documented Application Gateway for Containers features, mTLS termination and dynamic client-certificate header forwarding are separate capabilities. FrontendTLSPolicy can validate the client certificate, and access logs expose frontendTLSPeerFingerprint, but that fingerprint is not available as a request-header rewrite variable. The Gateway API RequestHeaderModifier can set static header values; it cannot populate a per-request thumbprint from the TLS session.

Also, frontend mTLS on a listener requires a valid client certificate, so one listener cannot simultaneously make mTLS optional for some clients. Use separate hostnames/listeners: one HTTPS listener with FrontendTLSPolicy for mTLS clients and another normal HTTPS listener for other clients, both routing to the same service.

If the backend must receive and validate the certificate or thumbprint, terminate mTLS in an in-cluster proxy/service mesh or use Application Gateway v2, which supports client-certificate server variables and rewrite rules. Never trust a client-supplied fingerprint header; strip it at the edge.

Aleksandar 0 Reputation points

2026-07-19T08:19:55.57+00:00

The idea is to have one listener for mTLS clients. Another listener would be used for the clients that do not used mTLS. Both of them would route to the same service.

So based on what what you are saying and the documentation - this forwarding of the headers is not possible to be done with Application Gateway for Containers and Gateway API?
Aleksandar 0 Reputation points

2026-07-19T08:20:26.1933333+00:00

The idea is to have one listener for mTLS clients. Another listener would be used for the clients that do not used mTLS. Both of them would route to the same service.

So based on what what you are saying and the documentation - this forwarding of the headers is not possible to be done with Application Gateway for Containers and Gateway API?