How to turn off SSL validation on an Azure API Management policy?

Question

I have APIM setup and i am adding a validate-jwt policy to my apis. I have my own openid connect server. however when i add the policy i get an error that it could not connect to my openid-configuration endpoint because it can't validate the certificate.

my identity server is hosted in my service fabric cluster and is in a dev environment so i am using a self-signed certificate.

is there any way to tell APIM to trust the certificate so it can contact my server?

<validate-jwt header-name=”Authorization” failed-validation-httpcode=”401″ failed-validation-error-message=”Access token is missing or invalid.”>  
    <openid-config url=”https://myserver/.well-known/openid-configuration” />  
    <required-claims>  
        ...
    </required-claims>  
</validate-jwt>

Thanks for any help.

Did u try switch off TLS,docs.microsoft.com/en-us/azure/api-management/… — Inzi

DixitArora-MSFT DixitArora-MSFT · Accepted Answer · 2019-06-03T09:07:34

I don't think it's possible at the moment. You could switch to http instead of https in openid-config, if you're comfortable with that.

How to turn off SSL validation on an Azure API Management policy?

1 Answers