How can I require SSL when I offload at an Azure application gateway?

Question

I am transitioning my ASP.Net web site to Azure hosting. I am using an application gateway with SSL offload, so my individual load balanced web servers do not have the SSL cert installed. Since SSL is handled on the application gateway, how do I require SSL from the client and redirect from HTTP to HTTPS?

I just found this and I'm going to give it a try: docs.microsoft.com/en-us/azure/application-gateway/… — Keith Walton
Possible duplicate of Redirect HTTP to HTTPS in Azure Application Gateway — Keith Walton

Chris Butler Chris Butler · Accepted Answer · 2021-06-17T23:15:49

I do this with close to 300 sites running though 3 separate application gateways, once you get it configured, it works well.

The answer lies in the configuration of the Listener/Rule pairs.

You will need two Listeners (one for HTTP, and one for HTTPS) and two Rules (again one for HTTP, and one for HTTPS) for each site to achieve this.

Here it is laid out step by step for you:

1. Create a new HTTP Listener: Give it a name like 'Listener_HTTP', Port 80, HTTP Protocol, Multi site listener type, put in your host name like so:

2. Create a new HTTPS Listener: Name 'Listener_HTTPS, Port 443, HTTPS Protocol, either choose an existing, or create a new SSL cert, Multi site listener type, put in your host name like so:

3. Create a new HTTP Rule: Create a new Rule, name 'Rule_HTTP'. On the 'Listener tab, link it to the HTTP listener created in Step 1 above like so:

On the 'Backend Targets' tab, the Target Type should be 'Redirection', redirection type should be 'Found', and redirection target should be your HTTPS listener created in Step 2 above as follows:

4. Create a new HTTPS Rule: Create a new rule, name 'Rule_HTTPS', on the 'Listener' tab point it at the HTTPS Listener created in Step 2 above, as follows:

On the 'Backend Targets' tab, Set Target type to 'Backend Pool' and point it at your chosen Backend Pool and HTTP settings as follows (this answer assumes you already have those setup):

An voila! There you have it! Any requests that hit HTTPS directly will go straight through to the backend pool. Any that hit HTTP, will get looped back to the HTTPS Listener effectively achieving the forced redirection you are looking for.

How can I require SSL when I offload at an Azure application gateway?

2 Answers