How to configure Azure Application Gateway work with AKS via SSL

4 min readMar 31, 2019

The tutorial will provide steps to deploy Application gateway and AKS. The two resources communicate with SSL.

  1. Deploy an AKS cluster

2. Create self-signed certificate for demo purpose

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-out aks-ingress-tls.crt \
-keyout aks-ingress-tls.key \
-subj "/"

3. Create secret in AKS with the TLS certificate generated previously

kubectl create secret tls aks-ingress-tls \
--key aks-ingress-tls.key \
--cert aks-ingress-tls.crt

4. Deploy nginx ingress controller manually

a. wget

b. Modify the ‘args’ in ‘nginx-ingress-controller’ deployment section. Add the parameter ‘--default-ssl-certificate=default/aks-ingress-tls’ and change version of nginx image to 0.23.0

c. kubectl apply -f mandatory.yaml

d. wget

e. Add below to the ‘annotation’ and remove the ‘http’ port “true”ports:
--name: https
port: 443
targetPort: https
f. kubectl apply -f cloud-generic.yaml

5. Deploy demo applications

6. Deploy demo ingress route

7. Test if the internal ingress controller works

kubectl run -it -rm aks-ingress-test -image=debianapt-get update && apt-get install -y curlcurl -kv https://<service IP>curl -kv https://<service IP>/whatever

The ‘Server Certificate’ should contain the information from the secret ‘aks-ingress-tls’

8. Download the ‘aks-ingress-tls.crt’ file and transfer to the CER certificate

a. Open the ‘crt’ file, ‘Details’ tab and ‘Copy to File’

b. Export it as ‘CER’ file

9. Transfer the ‘aks-ingress-tls.key’ and ‘aks-ingress-tls.crt’ to pfx certificate and download

openssl pkcs12 -export -out tls.pfx -inkey aks-ingress-tls.key -in aks-ingress-tls.crt

10. Deploy the application gateway

12. Add the ‘https’ custom probe. You need to define per your own service detail

13. Add the ‘https’ setting to the application gateway. Use the ‘CER’ certificate you extracted before and the health probe created in last step

14. Add backend Pool with the address of your internal Ingress Controller Service

15. Modify the ‘http setting’ to the https one

16. Verify if backend is healthy

17. Verify from the browser with DNS resolves the ‘’ to the public IP of the application gateway