I have an Azure Web App running on Windows with .Net 8. In my web app I have an API route that requires a certificate authentication. The other routes use AAD authentication.

Installing it on-premise it works with following web.config:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <location path="." inheritInChildApplications="true">
    <system.webServer>
      <handlers>
        <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
      </handlers>
      <aspNetCore processPath="dotnet" arguments=".MyApp.dll" stdoutLogEnabled="false" stdoutLogFile=".logsstdout" hostingModel="inprocess" />
    </system.webServer>
  </location>
  <location path="api">
    <system.webServer>
        <security>
            <access sslFlags="SslNegotiateCert" />
        </security>
    </system.webServer>
  </location>
</configuration>

and changing the applicationHost.config in C:WindowsSystem32inetsrvconfig from

<section name="access" overrideModeDefault="Deny" />

to:

<section name="access" overrideModeDefault="Allow" />

On my Azure Web App I don’t have the applicationHost.config so read about the applicationHost.xdt and added following setting in /site/applicationHost.xdt:

<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
    <system.webServer>
        <configSections>
            <section name="access" overrideModeDefault="Allow" xdt:Transform="SetAttributes" xdt:Locator="Match(name)"/>
        </configSections>
    </system.webServer>
</configuration>

But of course this does not work. Can please someone assist me how to enable API access by cert like I did on-premise.

The error I get from my client trying an invoke-webrequest is just:

Microsoft.PowerShell.Commands.HttpResponseException: Response status code does not indicate success: 500 (Internal Server Error).