I have implemented an API Management logic in the inbound policies so that some of the received certificate information is passed to an external service that does some checks on that information and returns true or false depending on the case. If validated, the call will continue through the backend URL.
The API Management is implemented in Consumption tier, with its corresponding Request client certificate properly set to Yes.
The problem is, this logic is only executed when the incoming certificate includes the private key (e.g. .pfx format). When the incoming certificate is public, the API management doesn't even execute the inbound policy, but rejects the incoming call with a 403 Forbidden.
I know it doesn't get to the inbound policy because I added this piece of code at the very beginning for testing purposes:
<choose>
<when condition="@(context.Request.Certificate == null || context.Request.Certificate.Issuer != "My expected certificate issuer")" >
<return-response>
<set-status code="403" reason="Invalid client certificate" />
</return-response>
</when>
</choose>
And when the certificate is public, I don't get the 'Invalid client certificate' message but the standard 'Forbidden'.
As all available setups in the API Management refer to certificates with key (e.g. you cannot upload in the Certificates tab a public certificate, and when selecting one from the key vault, it will include of course the private key), I wonder whether the incoming certificate must also include the key as a requirement.
Do you know if there is any requirement on that matter that forces the incoming certificate to include the private key?
If this is not the case, do you know what might be missing in my setup?