DNS configuration for Web App Custom Domains with Application Gateway + Traffic Manager for end to end SSL

Question

I have to configure App Gtwy between Traffic Manager and Azure Web apps. I have a custom domain for my web app and uploaded certs (pfx and cer) in App gateway. Added App Gtwy endpoint in Traffic Manager Profile. Uploaded the pfx cert in Azure Web App. Added DNS entry from custom domain to Traffic Manager Public endpoint.

Now how to have end to end SSL configured in App Gateway?. While doing SSL binding in Web app, HostName is not getting validated as there is already a CNAME configured for my custom domain to Traffic Manager public endpoint.

Can someone please help me in understanding how the DNS configuration should look in this case?

Answer 1

When configuring your DNS entries, using Dig Web Interface to verify what DNS entries are configured for your hostnames.

You will have to make sure both custom domains you use are configured via the custom domains blade on the webapp. Then you can point the domain back to the CNAME of the Application Gateway.

DNS Configuration :

Hostname pointing at the CNAME of the Application Gateway IP Certificate.

For more details, you could refer to this blog and the article about Configure end-to-end SSL by using Application Gateway .

Answer 2

Alternatively you could use a different certificate at the web app backend. You could create the webapp without a custom domain and use a different certificate tied to its FQDN <app_name>.azurewebsites.net . This certificate could be used to configure end to end SSL. The pfx would be used by Application Gateway's listener. The custom domain can continue to point to Traffic Manager endpoint which would get resolved to Application Gateway VIP. Application Gateway would then route traffic to web app in the backend using its FQDN.