Azure应用网关PFX证书上传异常：现有网关与创建时格式限制差异咨询

Hey there! Let me clear up this confusion for you—it’s not a hidden Easter egg, and you’re not making a mistake in your operations. The difference in supported certificate formats comes down to what the certificate is used for in different scenarios:

1. 后端池HTTP设置里的.cer证书：用于后端服务器身份验证 #

When you’re configuring HTTP settings for a backend pool, the certificate you upload here is meant to verify the identity of your backend servers (i.e., trust the SSL certificate presented by the backend). This only requires the public key part of a certificate, which is what .cer files provide (they’re usually root or intermediate CA certificates that issued your backend server’s SSL cert).

PFX files include both public and private keys, which aren’t needed here—hence the format error when you try to upload one in this specific section.

2. 创建新网关/CLI命令里的PFX证书：用于网关的SSL加密处理 #

• When creating a new application gateway, the option to upload a PFX is tied to configuring frontend SSL listeners or backend SSL offloading. In these cases, the gateway needs the full certificate (including private key) to encrypt/decrypt traffic between clients and the gateway, or between the gateway and backend servers.
• The CLI command az network application-gateway ssl-cert create is designed to add gateway-level SSL certificates for these encryption scenarios, not for backend server authentication. That’s why it accepts PFX files without issues.

3. 为什么文档容易混淆？ #

Azure’s docs sometimes don’t explicitly call out the distinction between these two certificate use cases, which leads to confusion like yours. The key takeaway is:

• Use .cer when you need to trust backend server certificates (backend pool HTTP settings)
• Use PFX when you need the gateway to handle SSL encryption (frontend listeners, SSL offloading, or via the gateway’s SSL cert management section)

内容的提问来源于stack exchange，提问作者BlindSniper