Skip to content

[Network] az network application-gateway ssl-profile add/update: Expose client authentication mode #34090

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
spalabatla26 wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

[Network] az network application-gateway ssl-profile add/update: Expose client authentication mode #34090

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/azure-cli/HISTORY.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,7 @@ Release History
* `az network public-ip create/update`: Add `--ddos-custom-policy` to attach a DDoS custom policy (#33812)
* `az network application-gateway waf-policy managed-rule rule-set update`: Allow updating rule group without rule IDs (#33871)
* `az network private-endpoint-connection`: Add provider `Microsoft.HardwareSecurityModules/paymentHsmClusters` (#33889)
* `az network application-gateway ssl-profile add/update`: Expose `--auth-configuration` to support mTLS `verify-client-auth-mode=Passthrough|Strict`

@necusjz Ethan Yang (necusjz) Sep 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please revert it.


**Packaging**

Expand Down
4 changes: 4 additions & 0 deletions src/azure-cli/azure/cli/command_modules/network/_help.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1721,6 +1721,8 @@
examples:
- name: Add ssl profile for an existing application gateway.
text: az network application-gateway ssl-profile add --gateway-name MyAppGateway -g MyResourceGroup --name MySslProfile
- name: Add ssl profile with mutual authentication (mTLS) in passthrough mode. In Passthrough mode the application gateway forwards the client certificate to the backend without verifying it, so certificate validation is delegated entirely to the backend server. Use Strict to have the gateway validate the client certificate itself.
text: az network application-gateway ssl-profile add --gateway-name MyAppGateway -g MyResourceGroup --name MySslProfile --auth-configuration verify-client-auth-mode=Passthrough
"""

helps['network application-gateway ssl-profile update'] = """
Expand All @@ -1729,6 +1731,8 @@
examples:
- name: Update ssl profile for an existing application gateway.
text: az network application-gateway ssl-profile update --gateway-name MyAppGateway -g MyResourceGroup --name MySslProfile --client-auth-configuration False
- name: Switch an existing ssl profile to mutual authentication (mTLS) passthrough mode. In Passthrough mode the application gateway forwards the client certificate to the backend without verifying it, leaving validation to the backend server.
text: az network application-gateway ssl-profile update --gateway-name MyAppGateway -g MyResourceGroup --name MySslProfile --auth-configuration verify-client-auth-mode=Passthrough
"""

helps['network application-gateway ssl-profile remove'] = """
Expand Down
38 changes: 36 additions & 2 deletions src/azure-cli/azure/cli/command_modules/network/custom.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1006,6 +1006,24 @@ def show_ag_backend_health(cmd, resource_group_name, application_gateway_name, e

# region application-gateway ssl-profile
class SSLProfileAdd(_SSLProfileAdd):
AZ_HELP = {
**_SSLProfileAdd.AZ_HELP,
"examples": [
{
"name": "Add an SSL profile for an existing application gateway.",
"text": "az network application-gateway ssl-profile add --gateway-name MyAppGateway "
"-g MyResourceGroup --name MySslProfile",
},
{
"name": "Add an SSL profile in Passthrough mode. The gateway forwards the client certificate "
"to the backend without verifying it.",
"text": "az network application-gateway ssl-profile add --gateway-name MyAppGateway "
"-g MyResourceGroup --name MySslProfile "
"--auth-configuration verify-client-auth-mode=Passthrough",
},
],
}

@classmethod
def _build_arguments_schema(cls, *args, **kwargs):
from azure.cli.core.aaz import AAZBoolArg, AAZListArg, AAZResourceIdArg, AAZResourceIdArgFormat
Expand All @@ -1024,7 +1042,6 @@ def _build_arguments_schema(cls, *args, **kwargs):
"/applicationGateways/{gateway_name}/trustedClientCertificates/{}",
),
)
args_schema.auth_configuration._registered = False
args_schema.client_certificates._registered = False
return args_schema

Expand All @@ -1044,6 +1061,24 @@ def _output(self, *args, **kwargs):


class SSLProfileUpdate(_SSLProfileUpdate):
AZ_HELP = {
**_SSLProfileUpdate.AZ_HELP,
"examples": [
{
"name": "Update SSL profile for an existing application gateway.",
"text": "az network application-gateway ssl-profile update --gateway-name MyAppGateway "
"-g MyResourceGroup --name MySslProfile --client-auth-configuration False",
},
{
"name": "Update an SSL profile to Passthrough mode. The gateway forwards the client certificate "
"to the backend without verifying it.",
"text": "az network application-gateway ssl-profile update --gateway-name MyAppGateway "
"-g MyResourceGroup --name MySslProfile "
"--auth-configuration verify-client-auth-mode=Passthrough",
},
],
}

@classmethod
def _build_arguments_schema(cls, *args, **kwargs):
from azure.cli.core.aaz import AAZBoolArg, AAZListArg, AAZResourceIdArg, AAZResourceIdArgFormat
Expand All @@ -1065,7 +1100,6 @@ def _build_arguments_schema(cls, *args, **kwargs):
),
nullable=True,
)
args_schema.auth_configuration._registered = False
args_schema.client_certificates._registered = False
return args_schema

Expand Down
Loading
Loading