← Knowledge base

Azure

Azure Front Door terminates client TLS and establishes a separate connection to the origin. Application Gateway, API Management, and application ingress have their own configuration and evidence requirements.

Evidence to collect

  1. Identify the exact Azure service and tier handling each TLS hop.
  2. Consult its current supported protocol and group documentation; do not infer service support from SymCrypt algorithm support.
  3. Record an observed selected group at the hostname you use. If service documentation or connection evidence does not identify the group, record unknown.
  4. Keep origin certificate validation enabled. Do not bypass a managed gateway solely to obtain a different test result.

Record the scope and result

Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.

Official references

Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.