Custom Domain & Certificate Binding on Azure Function App Behind Application Gateway

KRISHNA, AMAL 20 Reputation points
2026-11-02T08:17:07.8933333+00:00

Traffic flows from app gateway to function app.

Environment:

  • Azure Application Gateway v2 (WAF_v2)
  • Azure Function App (Flex Consumption - Python)
  • SSL termination at Application Gateway using certificate from Azure Key Vault
  • Backend communication over HTTPS (port 443)

Architecture:

Client (Mobile App)

│

│ HTTPS (DigiCert OV certificate - SSL pinning enabled)

▼

Application Gateway

│ SSL Certificate: from Key Vault (DigiCert)

│

│ HTTPS (backend_http_settings)

│ pick_host_name_from_backend_address = true

▼

Azure Function App

│ Default hostname: *.azurewebsites.net

│ Certificate: Azure managed (default)

Application Gateway Backend HTTP Settings:

backend_http_settings = {

port = 443

protocol = "Https"

pick_host_name_from_backend_address = true

}

backend_pool_fqdns = ["my-function-app.azurewebsites.net"]

Questions:

Is custom domain binding on Function App required when Application Gateway is configured with pick_host_name_from_backend_address = true and backend pool uses the Function App's default *.azurewebsites.net hostname?

  1. Is uploading a custom certificate to Function App necessary for App Gateway → Function App HTTPS communication, or does Azure's managed certificate for *.azurewebsites.net suffice?

Are there any scenarios where custom domain binding on Function App would be required in this architecture (App Gateway fronting Function App)?

Azure Application Gateway
Azure Application Gateway

An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. KRISHNA, AMAL 20 Reputation points
    2026-11-02T08:17:59.4266667+00:00

    Questions:

    Is custom domain binding on Function App required when Application Gateway is configured with pick_host_name_from_backend_address = true and backend pool uses the Function App's default *.azurewebsites.net hostname?

    Is uploading a custom certificate to Function App necessary for App Gateway → Function App HTTPS communication, or does Azure's managed certificate for *.azurewebsites.net suffice?

    Are there any scenarios where custom domain binding on Function App would be required in this architecture (App Gateway fronting Function App)?

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-02T08:17:59.28+00:00

    No custom-domain binding or certificate upload is required on the Function App when the backend target is my-function-app.azurewebsites.net and Application Gateway uses that FQDN as the backend TLS hostname.

    Keep the two TLS connections logically separate:

    1. Client → Application Gateway
      • Listener hostname: your public custom domain.
      • Listener certificate: the DigiCert certificate from Key Vault.
      • Mobile certificate pinning applies to this certificate.
    2. Application Gateway → Function App
      • Backend pool target: my-function-app.azurewebsites.net.
      • Protocol: HTTPS.
      • Port: 443.
      • Select Pick hostname from backend target.
      • Keep certificate-chain, expiry, and SNI validation enabled.

    With Application Gateway v2, picking the hostname from the backend target sets SNI to the backend-pool FQDN. The certificate presented by the backend must match that FQDN.^1^

    Azure Functions already provides a platform-managed certificate for the default *.azurewebsites.net domain, including on Flex Consumption.^2^ Azure-managed *.azurewebsites.net domains require no additional certificate configuration.^3^

    Application Gateway trusts certificates issued by public certificate authorities and implicitly trusts Azure App Service and other Azure web-service backends. Therefore, no backend certificate or trusted-root upload is needed for this configuration.^1^

    Health probe configuration

    If using the default probe, the hostname selected in the associated backend setting is used for backend TLS validation.

    If using a custom probe, configure it as follows:

    • Protocol: HTTPS
    • Host: select Pick hostname from backend setting, or explicitly enter my-function-app.azurewebsites.net
    • Path: an anonymous endpoint that returns an accepted success status
    • Associate the probe with the HTTPS backend setting

    The probe hostname and backend-setting hostname must match the certificate subject name used for SNI. Otherwise, the backend can be marked unhealthy and Application Gateway can return HTTP 502.^4^

    Check the result under:

    Azure portal → Application Gateway → Backend health

    The Function App backend should report Healthy.

    When a custom domain is required on the Function App

    Bind a custom domain and matching certificate to the Function App only when the backend TLS connection itself must use that custom hostname. Examples include:

    • The backend pool or backend setting uses api.contoso.com rather than my-function-app.azurewebsites.net.
    • A custom probe sends api.contoso.com as its TLS/HTTP hostname.
    • The application requires the original public custom hostname in the backend Host header and the gateway is configured to preserve that hostname rather than override it with the Function App hostname.
    • Backend routing, authorization, or application logic explicitly depends on a custom backend host.
    • An organizational policy requires the same custom DNS identity across both TLS connections.

    In those cases:

    1. Map the custom domain to the Function App.
    2. Add a certificate whose subject/SAN covers that domain.
    3. Bind the certificate to the custom domain.
    4. Configure the Application Gateway backend hostname/SNI and probe hostname to use the same custom domain.

    App Service requires a certificate binding when HTTPS is served through a custom domain.^5^

    If a private-CA or self-signed certificate is used instead, upload its corresponding root CA certificate to the Application Gateway backend setting. This is not necessary for the current *.azurewebsites.net platform certificate because Application Gateway’s default trust store supports public CAs and trusted Azure services.^6^

    A custom domain configured only on the Application Gateway listener does not require the same domain or certificate to be installed on the Function App. TLS is terminated at the listener, and Application Gateway creates a separate TLS session to the *.azurewebsites.net backend.^1^

    References

    1. Overview of TLS termination and end to end TLS with Application Gateway
    2. Azure Functions hosting options
    3. What is TLS/SSL in Azure App Service?
    4. Troubleshoot backend health issues in Application Gateway
    5. Enable HTTPS for a custom domain in Azure App Service
    6. Application Gateway backend settings configuration
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.