Examkin

Question

Difficulty: MediumProvision and Configure Azure API Management

You are configuring a connection to a custom backend API from an Azure API Management (APIM) instance. The backend API is hosted on-premises and secured using a TLS/SSL certificate signed by a private internal Certificate Authority (CA) that is not publicly trusted. When APIM attempts to forward requests to the backend API, the connection fails with an HTTP 500 error due to a TLS handshake failure. You need to resolve the error and ensure that APIM can establish a secure TLS connection to the backend API while maintaining strict TLS validation. Which of the following actions should you perform?

  1. Upload the public root CA certificate to the Certificates section of the API Management instance.Answer
  2. B
    Create a custom backend resource in API Management and set the skipCertificateChainValidation property to true in the backend configuration.
  3. C
    Store the root CA certificate in an Azure Key Vault and grant the API Management system-assigned managed identity the GET permission to Key Vault secrets.
  4. D
    Add the authentication-certificate policy to the inbound processing section of the API and reference the thumbprint of the client certificate.

Answer

Upload the public root CA certificate to the Certificates section of the API Management instance.
Uploading the public root CA certificate of the private Certificate Authority to the Certificates section of the API Management instance allows the gateway to build the trust chain and validate the backend certificate. This resolves the TLS handshake failure while maintaining strict validation.

Step-by-Step Solution

1
Obtain the public root CA certificate (typically in .cer format) of the private internal Certificate Authority that signed the backend API's TLS certificate.
The public root CA certificate is prepared for import.
API Management needs this certificate to construct and verify the trust chain of the backend server's certificate.
2
In the Azure Portal, navigate to the API Management instance, select Certificates under the Security section, and upload the certificate to the CA certificates tab.
The private CA is added to the trusted store of the API Management instance.
This establishes trust at the API Management infrastructure level, enabling successful TLS handshakes with any backend server whose certificate is signed by this CA.

Key Concept

Configuring trusted CA certificates in Azure API Management to secure backend communication.
Rate this question

Topics

Provision and Configure Azure API Management