Adatum requires end-to-end TLS: clients use HTTPS to the Application Gateway and the gateway must authenticate backend App Service certificates to prevent MITM inside their VNet. Which configuration achieves end-to-end TLS with Application Gateway validating the backend certificate chain?

To achieve end-to-end TLS with Application Gateway validating backend certificates, you must upload the public root CA certificate (or intermediate CA, if applicable) that signed the backend server's certificate to the Application Gateway's backend HTTP settings. Additionally, the backend HTTP setting protocol must be set to HTTPS. This configuration instructs the Application Gateway to establish an encrypted connection to the backend and validate the presented certificate against the uploaded trusted CA, preventing Man-in-the-Middle (MITM) attacks within the VNet. The option suggesting no certificate upload and default trust is incorrect because Application Gateway does not implicitly trust backend certificates for end-to-end TLS validation without a trusted CA. Installing a client certificate on App Service for mutual TLS is for client authentication, not for the gateway to validate the backend server's certificate. Terminating TLS at the gateway and using an external proxy defeats the purpose of end-to-end TLS and moves the authentication responsibility outside the Application Gateway.