How to use client certificate authentication in Azure Function App?

Hi ,

Thanks for reaching out to Microsoft Q&A.

No, azure functions (even Premium) does not have a native portal switch to upload and enforce client certificates like API Management does. If you wanted fully managed mTLS with certificate upload and enforcement at the gateway without code changes, you would need to place Azure API Management or Application Gateway in front of your Function App, configure mTLS there, and let APIM/App Gateway handle validation before calling your function app

What is possible? >

• You can enable "Require incoming client certificates" in the Function App > Configuration > General settings section.

When this is enabled, Azure App Service (which hosts Function Apps) will require clients to present a certificate for the TLS handshake to succeed.

• Azure will not validate the certificate against a list you upload, it only ensures the client presents some certificate.

The validation (against a CA, thumbprint, etc.) must be done inside your function code.

Key difference from API Management: In APIM, you can upload client certificates and enforce them at the gateway. In Function App, you must manually validate them in your code.

How to access the client certificate in Azure Function App code

When you enable "Require incoming client certificates", Azure puts the client certificate in a request header:

• Header name: X-ARR-ClientCert.This is a Base64-encoded representation of the certificate.

Important processing note:

Azure terminates TLS at the App Service front end.

• The certificate is not passed via raw TLS to your app instead, it is injected into the HTTP request headers after being Base64 encoded.
• This means you will not have direct access to the raw TLS session in your Spring Boot code; you will decode and parse the certificate from that header.

HTTPS with a custom domain for Function App

To use your own domain over HTTPS:

Buy or obtain a TLS certificate for your custom domain (PFX format, with private key).

1. In the Azure portal, go to Function App > Custom domains.

Add your domain and verify it using a TXT record in DNS.

1. Upload your certificate (PFX) under Function App > TLS/SSL settings > Private Key Certificates (.pfx).

Bind the uploaded certificate to your custom domain.

This handles server-side TLS (your Function App proving its identity).

Putting it all together for mTLS in Function App (Premium)

Flow:

1. Configure your Function App to Require client certificates.
2. Deploy your Java Spring Boot app in Functions (Premium plan).
3. On each request, read X-ARR-ClientCert from headers.
4. Decode and parse as X509Certificate.
5. Validate against:
   • CA chain you trust
   • Thumbprints of allowed certs
   • Expiry date / revocation
6. Return 401 Unauthorized if validation fails.

Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.