Azure托管WebAPI启用TLS双向认证：限制指定客户端证书访问

Great question! When securing an Azure-hosted Web API with mutual TLS (mTLS), you’ve got solid options beyond just manually checking certificate properties in code—let’s break down the best approaches, from the most secure infrastructure-level enforcement to flexible code-based validation.

This is the most secure approach because it blocks invalid requests before they even reach your API code, reducing your attack surface and simplifying management.

For Azure App Service #

• First, ensure you’ve enabled mTLS: Go to your App Service > TLS/SSL settings > Toggle on "Incoming client certificates".
• Use Access Restrictions to enforce trusted certificates:
  • Navigate to App Service > Networking > Access restrictions
  • Add a new rule, select "Client certificate" as the restriction type
  • Enter the thumbprints of your trusted client certificates (separate multiple thumbprints with commas)
  • App Service will automatically reject any request without a matching certificate thumbprint.

For Azure API Management (if you're using APIM) #

APIM lets you centralize certificate validation logic without modifying your API code:

• Enable mTLS for your APIM instance first, then add a validation policy to your API:

  <!-- Validate a single trusted certificate -->
  <validate-client-certificate thumbprint="ABC123DEF456..." validateCertificateChain="true" validateRevocation="true" />
  

  Or for a set of trusted thumbprints:

  <choose>
      <when condition="@(context.Request.Certificate?.Thumbprint != null && new[] {"ABC123", "DEF456"}.Contains(context.Request.Certificate.Thumbprint.ToUpper()))">
          <!-- Allow the request to proceed -->
      </when>
      <otherwise>
          <return-response>
              <set-status code="403" reason="Forbidden" />
              <set-body>Invalid or untrusted client certificate</set-body>
          </return-response>
      </otherwise>
  </choose>
  

If you need to validate custom certificate properties (like issuer, subject, or custom extensions), using HttpContext.Connection.GetClientCertificateAsync() is totally valid—just follow these best practices:

Basic Validation Example (ASP.NET Core) #

[ApiController]
[Route("api/secure")]
public class SecureApiController : ControllerBase
{
    // Store trusted thumbprints in App Service settings/Key Vault, not hardcoded!
    private readonly HashSet<string> _trustedThumbprints = new HashSet<string>
    {
        "ABC123DEF456...",
        "GHI789JKL012..."
    };

    [HttpGet]
    public async Task<IActionResult> GetSecureData()
    {
        var clientCert = await HttpContext.Connection.GetClientCertificateAsync();
        
        if (clientCert == null)
        {
            return Forbid("No client certificate provided.");
        }

        // Validate the certificate chain to avoid expired/revoked/untrusted certs
        using var chain = new X509Chain();
        chain.ChainPolicy.RevocationMode = X509RevocationMode.Online; // Use Online in production
        if (!chain.Build(clientCert))
        {
            return Forbid("Invalid certificate chain.");
        }

        // Check if the certificate is in our trusted list
        if (!_trustedThumbprints.Contains(clientCert.Thumbprint?.ToUpper()))
        {
            return Forbid("Untrusted client certificate.");
        }

        // Optional: Validate additional properties like issuer
        if (!clientCert.Issuer.Equals("CN=YourTrustedCA, O=YourOrganization", StringComparison.OrdinalIgnoreCase))
        {
            return Forbid("Certificate issuer not trusted.");
        }

        return Ok("Access granted.");
    }
}

Reusable Authorization Policy #

For cleaner, reusable logic across multiple endpoints, create a custom authorization policy:

// Custom requirement
public class TrustedClientCertificateRequirement : IAuthorizationRequirement { }

// Handler
public class TrustedClientCertificateHandler : AuthorizationHandler<TrustedClientCertificateRequirement>
{
    private readonly HashSet<string> _trustedThumbprints;

    public TrustedClientCertificateHandler(IConfiguration config)
    {
        _trustedThumbprints = new HashSet<string>(config.GetSection("TrustedCertThumbprints").Get<string[]>());
    }

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, TrustedClientCertificateRequirement requirement)
    {
        var httpContext = context.Resource as HttpContext;
        if (httpContext == null)
        {
            context.Fail();
            return Task.CompletedTask;
        }

        var clientCert = httpContext.Connection.ClientCertificate;
        if (clientCert == null)
        {
            context.Fail();
            return Task.CompletedTask;
        }

        // Validate chain and thumbprint
        using var chain = new X509Chain();
        if (chain.Build(clientCert) && _trustedThumbprints.Contains(clientCert.Thumbprint?.ToUpper()))
        {
            context.Succeed(requirement);
        }
        else
        {
            context.Fail();
        }

        return Task.CompletedTask;
    }
}

// Register in Program.cs
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("TrustedClientCert", policy =>
        policy.Requirements.Add(new TrustedClientCertificateRequirement()));
});

builder.Services.AddSingleton<IAuthorizationHandler, TrustedClientCertificateHandler>();

Then apply the policy to your controller/endpoint:

[Authorize(Policy = "TrustedClientCert")]
[ApiController]
[Route("api/secure")]
public class SecureApiController : ControllerBase { /* ... */ }

• Prioritize infrastructure-level validation: It’s more secure and easier to update (no code deployments needed to add/remove thumbprints)
• Always validate the certificate chain: Don’t just check thumbprints—ensure the certificate is issued by a trusted CA, not expired, and not revoked
• Store trusted thumbprints securely: Use Azure Key Vault or App Service application settings instead of hardcoding
• Log invalid attempts: Track untrusted certificate requests to detect potential attacks and troubleshoot issues

内容的提问来源于stack exchange，提问作者Ali