Generally Available: Keyless TLS on Application Gateway with Azure Key Vault Managed HSM

Azure Application Gateway now supports keyless TLS termination using certificates whose private keys stay in Azure Key Vault Managed HSM. Each TLS handshake signature is performed inside the HSM, and the private key is never exported to the gateway. 

This integration helps you: 

• Maintain private key custody within a dedicated HSM boundary. 
• Use managed identities and role-based access control for key access. 
• Monitor signing operations through Managed HSM diagnostic logs. 
• Obtain cryptographic evidence that the TLS key was generated and is stored in a FIPS 140-3 Level 3 validated HSM. 
• Support separation of duties and centralized key management. 

Learn more: 

• What is keyless TLS for Azure Application Gateway and Azure Key Vault Managed HSM? 
• Tutorial: Configure keyless TLS termination with Azure Key Vault Managed HSM 
• What is Azure Key Vault Managed HSM?