For Azure Application Gateway or standard web servers, you may need to download the public CA certificate used to sign client certs.