This article explains that a client certification authentication is possible with azure api management. Here is an excerpt from this article:
API Management provides the capability to secure access to APIs (i.e., client to API Management) using client certificates. Currently, you can check the thumbprint of a client certificate against a desired value. You can also check the thumbprint against existing certificates uploaded to API Management.
It contains a link to another article which explain how to add a client certificate to azure api management for the purpose of using client certificate in the context of using client certificate authentication when communicating with back end service only. This obviously requires loading a PFX file (which contains the private key).
However I am interested in using the api management for validating a client certificate from the consumer of my API hosted in the api management. The first article seemed to indicate the api management can be receiver of the client certificate for validating consumers. One of the policies from the first article is shown below:
<choose>
<when condition="@(context.Request.Certificate == null || !context.Deployment.Certificates.Any(c => c.Value.Thumbprint == context.Request.Certificate.Thumbprint))" >
<return-response>
<set-status code="403" reason="Invalid client certificate" />
</return-response>
</when>
</choose>
This means I should be able to upload only a public portion of client certificate from my API consumer. Yet, it does not allow non-pfx files. What am I missing here?
Sorry for the delay. The certificates that you can upload are primarily for authenticating with a backend. The recommended solution for doing client certificate validation is just to check the thumbprint value in the policy. If you feel that there is value in being able to upload client certs with just the public key, please add it to our uservoice. http://aka.ms/apimwish