Examkin

Question

Difficulty: HardProvision and Configure Azure API Management

You are configuring an Azure API Management (APIM) instance to route requests to a backend microservice deployed on an Azure Virtual Machine. The backend microservice uses a self-signed SSL/TLS certificate for secure communication. When testing the API in APIM, you receive a HTTP 500 Bad Gateway error because the APIM instance cannot validate the trust chain of the self-signed certificate. You need to configure APIM to successfully communicate with the backend service. Which of the following actions should you perform to resolve this issue?

  1. A
    Configure a user-assigned managed identity on the backend Azure Virtual Machine to sign the certificate, and update the API Management gateway to bypass client certificate authentication.
  2. B
    Add a cors policy inside the outbound section of the API configuration to bypass the certificate validation check for backend origins.
  3. Create a custom Backend resource in the API Management instance for the backend service, and disable backend certificate chain validation (for example, by setting the skipCertificateChainValidation parameter to true).Answer
  4. D
    Reference the self-signed certificate using an Azure Key Vault secret identifier in the API's inbound policy, without granting the API Management instance's system-assigned managed identity a secret GET permission on the Key Vault.

Answer

Create a custom Backend resource in the API Management instance for the backend service, and disable backend certificate chain validation (for example, by setting the skipCertificateChainValidation parameter to true).
Creating a custom Backend resource in the API Management instance and setting its skipCertificateChainValidation property to true allows API Management to establish a secure TLS connection with the backend even if it uses a self-signed certificate, bypassing the default trust chain validation.

Step-by-Step Solution

1
Identify the cause of the HTTP 500 Bad Gateway error.
Recognize that API Management fails to establish a TLS connection to the backend because the backend's self-signed certificate cannot be validated against a trusted root Certificate Authority (CA).
By default, API Management validates the entire certificate chain of backend services to ensure secure communication.
2
Select the appropriate API Management mechanism to handle self-signed certificates.
Determine that creating a custom Backend entity allows configuring specific TLS settings for that backend destination.
Standard API routing settings do not allow fine-grained certificate validation overrides; a custom Backend resource must be defined.
3
Configure the custom Backend resource to bypass certificate chain validation.
Disable certificate chain validation on the custom Backend resource (e.g., setting the skipCertificateChainValidation property to true).
This configuration tells API Management to accept the self-signed certificate presented by the backend service for TLS handshakes.

Key Concept

Bypassing certificate validation for custom backends in Azure API Management
Estimated Time:2m 0s
Rate this question

Topics

Provision and Configure Azure API Management