SSL/TLS Offloading with Key Vault

The gateway can improve performance by handling SSL/TLS encryption and decryption itself, a process called SSL/TLS offloading. This means backend servers don't have to manage certificates. You manage these certificates by integrating with Azure Key Vault. First, you create a user-assigned managed identity for the gateway and grant it permission to read certificates from Key Vault. Then, you configure the HTTPS listener to use a certificate stored in Key Vault. If your backend servers use certificates not signed by a public authority, you must upload the root certificate to the gateway to enable end-to-end TLS validation.