Azure-docs: Backend Authentication certificate issue

[sajithvasu]

Currently we are seeing issues with app gateway backend going unhealthy due to backend auth cert. Our current setup includes app gateway v1 SKU integrated with app services having custom domain enabled. We have private key .pfx issued by CA uploaded to app services and its public certificate .cer file uploaded to app gateway backend authentication as mentioned in this document. We have this setup in multiple places created last year and it all works fine.
For new setup, we have noticed that app gateway back-end becomes unhealthy. Error message shown - Backend server certificate is not whitelisted with Application Gateway. It seems like something changed on the app gateway starting this month.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 8b9fd744-85fa-0a72-4805-b92decdf05c5
• Version Independent ID: 948878b1-6224-e4c5-e65a-3009c4feda74
• Content: Quickstart - Configure end-to-end SSL encryption with Azure Application Gateway - Azure portal
• Content Source: articles/application-gateway/end-to-end-ssl-portal.md
• Service: application-gateway
• GitHub Login: @vhorne
• Microsoft Alias: absha

[TravisCragg-MSFT]

@sajithvasu I am not aware of any changes that have been made on the App Gateway side that would make this not work.

If you have properly added the certificate, and the backend pool is pointing to the custom domain (not the azurewebsites.net domain), then your best options are to either try the V2 SKU, or open a support request to troubleshoot further. If you do not have a support plan, please let me know,

[TravisCragg-MSFT]

@sajithvasu I would continue to work with the support engineers while they look deeper into your authentication certificate. An issue with your configuration needs to be ruled out first.

[sajithvasu]

@TravisCragg-MSFT: I have same configuration on different places which were built a while ago and those are perfectly working fine. Our configuration is similar to this article but we are using WAF V1 sku - https://www.domstamand.com/end-to-end-ssl-solution-using-web-apps-and-azure-application-gateway-multisite-hosting/
Can you recreate this scenario in your lab using multi-site and custom domain on appservices with SNI bind SSL and cert issued by different CA than Microsoft and not the default azurewebsites.net and you may hit this issue?

[sajithvasu]

Hi @TravisCragg-MSFT : Were you able to check this?

[bel-from-nz]

I had this same issue. Ended up swapping to App Gateway V2 instead using the Trusted CA cert option on the backend http settings

[sajithvasu]

@TravisCragg-MSFT: Any luck? Were you able to reproduce this scenario and check?

[TravisCragg-MSFT]

@sajithvasu This lab takes quite a long time to set up! I am currently experimenting with different ways to add the backend pools and heath probes to find a working configuration. I will let you know what I find.

Most of the best practice documentation involves the V2 SKU and not the V1.

[sajithvasu]

@TravisCragg-MSFT : Thank you! I will wait for the outcome. Just FYI. It worked fine for me with the new setup in the month of September with V1 SKU. This month for new environment build we started encountering this problem.

[sajithvasu]

@TravisCragg-MSFT : Did you find out anything?

[TravisCragg-MSFT]

@sajithvasu My apologies for this taking a long time, but there are some strange issues here(as you have already discovered). This will take some time to track down, fix, and the docs will need to be updated with limitations & best practices. I will post any updates here as soon as I have them.

[sajithvasu]

@TravisCragg-MSFT: Thanks for checking this. I will wait for your response. I will clean-up some of my older comments to keep it generic to all since the issue has been identified.

[JeromeVigne]

I am having the same issue with App GW v1 in front of an API Management. I just set it up and cannot get the health probe for HTTPS healthy. When I use v2 SKU with the option to trust the backend certificate from APIM it works. Unfortunately I have to use the v1 for this set-up.

[januschr]

We are in the same situation as @JeromeVigne: App Gateway v1 as front-end to API Management, the health probe is unhealthy with the "Backend server certificate is not whitelisted with Application Gateway." error. The v2 SKU is not an option at the moment due to lack of UDR support.
@JeromeVigne did you find a solution in your setup?